TechSpot

Window 8 with Pop up Installer and Pokki Menu

By rtcwlomax
Mar 2, 2015
  1. Hi,

    I'm having problems with Windows 8 since getting caught out installing a root tool (Odin) for my phone. The installer was full of viruses. I have attempted to remove it but some files still remain. Currently my Windows 8 home button is not working after thet last Malwarebytes restart, but when I mouse over it 'Pokki Menu' comes up. I also have a popup installer for 'AnyWhereAccess' that does not look trustworthy.

    Logs attached but please note DDS would not run as it gave the error 'DDS is not meant to run in Compatibility Mode'.

    I have included the log files from all 3 Malwarebyte scan since the computer got infected. Please advise.
     
  2. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    Scan 1 - 27/02/2015

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 27/02/2015
    Scan Time: 18:53:11
    Logfile: 27_02_15 Scan1.txt
    Administrator: No

    Version: 2.00.4.1028
    Malware Database: v2015.02.27.06
    Rootkit Database: v2015.02.25.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled

    OS: Windows 8.1
    CPU: x64
    File System: NTFS
    User: Me

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 439359
    Time Elapsed: 21 min, 2 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 1
    PUP.Optional.SuperFish, C:\Program Files (x86)\Lenovo\VisualDiscovery\VisualDiscovery.exe, 2324, Delete-on-Reboot, [5d1525fe7b0fc4720f77c448b551db25]

    Modules: 1
    PUP.Optional.SuperFish, C:\Program Files (x86)\Lenovo\VisualDiscovery\SuperfishCert.dll, Delete-on-Reboot, [9cd6fb289ceeb38374129676f70fd42c],

    Registry Keys: 30
    PUP.Optional.SuperFish, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\VisualDiscovery, Quarantined, [5d1525fe7b0fc4720f77c448b551db25],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE, Quarantined, [f97942e1cdbd1a1c38be9130ea19738d],
    PUP.Optional.Booster.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1146AC44-2F03-4431-B4FD-889BC837521F}{4ef60154}, Quarantined, [2f4343e0cbbfc76f47bfdde8be458b75],
    PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLAPLUGINS\@staging.google.com/globalUpdate Update;version=10, Quarantined, [cfa3f330abdf44f2809d8e9326df7f81],
    PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLAPLUGINS\@staging.google.com/globalUpdate Update;version=4, Quarantined, [a5cd4dd64d3d39fd53cbfc25ac599070],
    PUP.Optional.ConduitSearchProtect, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\CltMngSvc, Quarantined, [f2806db647431c1a8c27689343c1ac54],
    PUP.Optional.BoBrowser.A, HKU\S-1-5-21-1301979038-2669888510-292050220-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\BoBrowser, Quarantined, [a4ce61c2fb8f37ff30dbd7cc3fc418e8],
    PUP.Optional.CrossRider.A, HKU\S-1-5-21-1301979038-2669888510-292050220-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\HQCinema Pro 2.1V27.02-nv-ie, Quarantined, [720059ca6f1bad89fd08f2bcef14619f],
    PUP.Optional.ICinema.A, HKU\S-1-5-21-1301979038-2669888510-292050220-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\I - Cinema-nv-ie, Quarantined, [2c46c2619cee9d999bb910ac17eca15f],
    PUP.Optional.Nosibay.A, HKU\S-1-5-21-1301979038-2669888510-292050220-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Nosibay, Quarantined, [145e6db68406f046ea738624e41f6c94],
    PUP.Optional.CrossRider.A, HKU\S-1-5-21-1301979038-2669888510-292050220-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [353d58cbb5d57fb73889d43e7095b14f],
    PUP.Optional.WindApp.A, HKU\S-1-5-21-1301979038-2669888510-292050220-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\STORE\WindApp Tag, Quarantined, [2a48e340d4b6da5cdd1aafeccf34c13f],
    PUP.Optional.SelectionTool.A, HKU\S-1-5-21-1301979038-2669888510-292050220-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WTOOLS\Selection Tools Tag, Quarantined, [c1b15fc42d5dcf671ef9ebb78f740bf5],
    PUP.Optional.GlobalUpdate.T, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdate, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\globalUpdatem, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\globalUpdate.OneClickCtrl.10, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdate.OneClickCtrl.10, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{5645E0E7-FC12-43BF-A6E4-F9751942B298}, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\CLASSES\globalUpdate.Update3WebControl.4, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\globalUpdate.Update3WebControl.4, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.Clara.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\ClaraUpdater, Quarantined, [72008d961674fd39b7d8f3943cc710f0],

    Registry Values: 3
    PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE|path, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, Quarantined, [f97942e1cdbd1a1c38be9130ea19738d]
    PUP.Optional.WindApp.A, HKU\S-1-5-21-1301979038-2669888510-292050220-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|WindApp, "C:\Users\Damien\AppData\Roaming\Store\WindApp\WindApp.exe" /winstartup, Quarantined, [2250c95a3654e551ec26148e6c971de3]
    PUP.Optional.SelectionTools.A, HKU\S-1-5-21-1301979038-2669888510-292050220-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Selection Tools, "C:\Users\Damien\AppData\Roaming\WTools\Selection Tools\Selection Tools.exe" /winstartup, Quarantined, [a3cfef345d2d02345c7fa6ff41c2df21]

    Registry Data: 0
    (No malicious items detected)

    Folders: 10
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Download, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Install, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Offline, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\Offline\{CCE88FDB-2BB8-4FF9-933D-0030ACF8130B}, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.19219, Quarantined, [caa883a00a804cea3b53c6b320e3bd43],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.20074, Quarantined, [c0b2180b7812999d612d9bdeca39ce32],
    PUP.Optional.Clara.A, C:\Program Files (x86)\Common Files\ClaraUpdater, Quarantined, [72008d961674fd39b7d8f3943cc710f0],
    PUP.Optional.Nosibay.A, C:\Users\Damien\AppData\Roaming\Nosibay, Quarantined, [e38f869de3a77fb7247f8c028b780df3],

    Files: 58
    PUP.Optional.SuperFish, C:\Program Files (x86)\Lenovo\VisualDiscovery\VisualDiscovery.exe, Delete-on-Reboot, [5d1525fe7b0fc4720f77c448b551db25],
    PUP.Optional.SuperFish, C:\Program Files (x86)\Lenovo\VisualDiscovery\SuperfishCert.dll, Delete-on-Reboot, [9cd6fb289ceeb38374129676f70fd42c],
    PUP.Optional.OptimizerPro, C:\ProgramData\{ce82ef32-0ad0-c1f0-ce82-2ef320adbcc8}\1AB16RN51.exe, Quarantined, [73ff57cc5c2ef640bc06ae772ad8847c],
    PUP.Optional.CrossRider.A, C:\Users\Damien\AppData\Roaming\OAUOK.exe, Quarantined, [2151de457119e551fd5d7295a3637090],
    PUP.Optional.CrossRider.A, C:\Users\Damien\AppData\Roaming\REHXZDZS.exe, Quarantined, [f87a29faee9cf640a5b5749341c558a8],
    PUP.Optional.OutBrowse, C:\$Recycle.Bin\S-1-5-21-1301979038-2669888510-292050220-1002\$R5OEGI2.exe, Quarantined, [dc96a97a5f2b989e66e03fdf3dc512ee],
    PUP.Optional.OutBrowse, C:\$Recycle.Bin\S-1-5-21-1301979038-2669888510-292050220-1002\$REXM6S6.exe, Quarantined, [e78b2cf796f495a13c0aff1f8082c53b],
    PUP.Optional.OpenCandy, C:\Users\Damien\AppData\Local\Temp\utt67CC.tmp, Quarantined, [6909b46f31595cda109319e035d0e11f],
    PUP.Optional.BubbleDock.A, C:\Users\Damien\AppData\Local\Temp\AVBD.exe, Quarantined, [f082150efb8f26106094bfa424dd738d],
    PUP.Optional.CrossRider.A, C:\Users\Damien\AppData\Local\Temp\DwlTempFolder\temp.exe, Quarantined, [e58dec37c3c7e353f139a5457988847c],
    PUP.Optional.SelectionTools.A, C:\Users\Damien\AppData\Roaming\Selection Tools.installation.log, Quarantined, [343e80a36a206dc98dbbd1d0ce35bc44],
    PUP.Optional.BoBrowser.A, C:\Windows\System32\Tasks\Run_Bobby_Browser, Quarantined, [62102003cac0d3637401287c12f113ed],
    PUP.Optional.Bubbledock.A, C:\Users\Damien\AppData\Roaming\Bubble Dock.boostrap.log, Quarantined, [a6cc8b98c5c581b5638d456213f053ad],
    PUP.Optional.Bubbledock.A, C:\Users\Damien\AppData\Roaming\Bubble Dock.installation.log, Quarantined, [4e24dd4663274de9658b6344d92afc04],
    PUP.Optional.WindApp.A, C:\Users\Damien\AppData\Roaming\WindApp.boostrap.log, Quarantined, [bbb779aaa1e995a1faf72a7d50b39e62],
    PUP.Optional.WindApp.A, C:\Users\Damien\AppData\Roaming\WindApp.installation.log, Quarantined, [1e54ab7897f3261011e02c7b5ea5cd33],
    PUP.Optional.BubbleDock.A, C:\Users\Damien\AppData\Local\Temp\Bubble-Dock_ES.dat, Quarantined, [0171131096f4dc5abe47e6c324df817f],
    PUP.Optional.BubbleDock.A, C:\Users\Damien\AppData\Local\Temp\Bubble-Dock_FR.dat, Quarantined, [b9b937ece8a29a9ca065c1e88b78bd43],
    PUP.Optional.BubbleDock.A, C:\Users\Damien\AppData\Local\Temp\Bubble-Dock_GB.dat, Quarantined, [afc3ce55d9b1d06672939e0b9c6710f0],
    PUP.Optional.BubbleDock.A, C:\Users\Damien\AppData\Local\Temp\Bubble-Dock_IT.dat, Quarantined, [1161150ec7c362d48a7b476208fbfa06],
    PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job, Quarantined, [2d451a09a6e4ad89a95c16091ee7e21e],
    PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore, Quarantined, [086a2ef5f59524121ee857c8a362e020],
    PUP.Optional.GlobalUpdate.A, C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job, Quarantined, [8fe372b1d7b350e6c245170806ff7d83],
    PUP.Optional.GlobalUpdate.A, C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA, Quarantined, [0b67d0535d2ddd59b65276a9ce37837d],
    PUP.Optional.ConduitSearchProtect, C:\Program Files (x86)\LenovoBrowserGuard\Main\bin\CltMngSvc.exe, Delete-on-Reboot, [f2806db647431c1a8c27689343c1ac54],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleCrashHandler.exe, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdate.exe, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateBroker.exe, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateHelper.msi, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\GoogleUpdateOnDemand.exe, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdate.dll, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\goopdateres_en.dll, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\psmachine.dll, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.T, C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\psuser.dll, Quarantined, [89e9b370a8e267cf036f26530201847c],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.19219\GoogleCrashHandler.exe, Quarantined, [caa883a00a804cea3b53c6b320e3bd43],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.19219\GoogleUpdate.exe, Quarantined, [caa883a00a804cea3b53c6b320e3bd43],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.19219\GoogleUpdateBroker.exe, Quarantined, [caa883a00a804cea3b53c6b320e3bd43],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.19219\GoogleUpdateHelper.msi, Quarantined, [caa883a00a804cea3b53c6b320e3bd43],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.19219\GoogleUpdateOnDemand.exe, Quarantined, [caa883a00a804cea3b53c6b320e3bd43],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.19219\goopdate.dll, Quarantined, [caa883a00a804cea3b53c6b320e3bd43],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.19219\goopdateres_en.dll, Quarantined, [caa883a00a804cea3b53c6b320e3bd43],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.19219\npGoogleUpdate4.dll, Quarantined, [caa883a00a804cea3b53c6b320e3bd43],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.19219\psmachine.dll, Quarantined, [caa883a00a804cea3b53c6b320e3bd43],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.19219\psuser.dll, Quarantined, [caa883a00a804cea3b53c6b320e3bd43],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.20074\GoogleCrashHandler.exe, Quarantined, [c0b2180b7812999d612d9bdeca39ce32],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.20074\GoogleUpdate.exe, Quarantined, [c0b2180b7812999d612d9bdeca39ce32],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.20074\GoogleUpdateBroker.exe, Quarantined, [c0b2180b7812999d612d9bdeca39ce32],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.20074\GoogleUpdateHelper.msi, Quarantined, [c0b2180b7812999d612d9bdeca39ce32],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.20074\GoogleUpdateOnDemand.exe, Quarantined, [c0b2180b7812999d612d9bdeca39ce32],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.20074\goopdate.dll, Quarantined, [c0b2180b7812999d612d9bdeca39ce32],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.20074\goopdateres_en.dll, Quarantined, [c0b2180b7812999d612d9bdeca39ce32],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.20074\npGoogleUpdate4.dll, Quarantined, [c0b2180b7812999d612d9bdeca39ce32],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.20074\psmachine.dll, Quarantined, [c0b2180b7812999d612d9bdeca39ce32],
    PUP.Optional.GlobalUpdate.A, C:\Users\Damien\AppData\Local\Temp\comh.20074\psuser.dll, Quarantined, [c0b2180b7812999d612d9bdeca39ce32],
    PUP.Optional.Clara.A, C:\Program Files (x86)\Common Files\ClaraUpdater\ClaraUpdater.exe, Quarantined, [72008d961674fd39b7d8f3943cc710f0],
    PUP.Optional.CrossRider.A, C:\Users\Damien\AppData\Roaming\Mozilla\Firefox\Profiles\8c3uwrer.default\prefs.js, Good: (), Bad: (user_pref("extensions.crossrider.bic", "14bcc4bebb5934c90242a9f265a1a71c");), Replaced,[670bed369af0fb3b8c7fa86840c60af6]

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
    Last edited: Mar 2, 2015
  3. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    Scan 2 - 27/02/2015

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 27/02/2015
    Scan Time: 20:01:46
    Logfile: 27_02_15_1 Scan.txt
    Administrator: Yes

    Version: 2.00.4.1028
    Malware Database: v2015.02.27.07
    Rootkit Database: v2015.02.25.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled

    OS: Windows 8.1
    CPU: x64
    File System: NTFS
    User: Me

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 438922
    Time Elapsed: 17 min, 17 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 0
    (No malicious items detected)

    Files: 1
    PUP.Optional.CrossRider.A, C:\Users\Damien\AppData\Roaming\Mozilla\Firefox\Profiles\8c3uwrer.default\prefs.js, Good: (), Bad: (user_pref("extensions.crossrider.bic", "14bcc4bebb5934c90242a9f265a1a71c");), Replaced,[de957da62d5d69cd907b739d7e88d42c]

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
    Last edited: Mar 2, 2015
  4. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    Scan 3 - 02/03/2015

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 02/03/2015
    Scan Time: 15:13:27
    Logfile: 02_03_15 Scan.txt
    Administrator: Yes

    Version: 2.00.4.1028
    Malware Database: v2015.03.02.04
    Rootkit Database: v2015.02.25.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled

    OS: Windows 8.1
    CPU: x64
    File System: NTFS
    User: Me

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 439953
    Time Elapsed: 16 min, 9 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 0
    (No malicious items detected)

    Files: 1
    PUP.Optional.Changead, C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\vnse3041.tmp, Quarantined, [0bb1bd83b0da5fd77a57d03ee81b926e],

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
    Last edited: Mar 2, 2015
  5. Broni

    Broni Malware Annihilator Posts: 52,898   +344

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ===============================

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2

    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Create new restore point before proceeding with the next step....
    How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

    Download [​IMG] Malwarebytes Anti-Rootkit (MBAR) to your desktop.
    • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
    • Double click on downloaded file. OK self extracting prompt.
    • MBAR will start. Click "Next" to continue.
    • Click in the following screen "Update" to obtain the latest malware definitions.
    • Once the update is complete select "Next" and click "Scan".
    • When the scan is finished and no malware has been found select "Exit".
    • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
    • Open the MBAR folder located on your Desktop and paste the content of the following files in your next reply:
      • "mbar-log-{date} (xx-xx-xx).txt"
      • "system-log.txt"
    NOTE. If you see This version requires you to completely exit the Anti Malware application message right click on the Malwarebytes Anti-Malware icon in the system tray and click on Exit.
     
    rtcwlomax likes this.
  6. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    Hi Broni,

    Many thanks for your help.

    Following both scans the Pokki Menu still has control of my Home Button. The Pokki Menu was created on 19 Feb but I installed the virus/malware installer on 27 Feb. Not sure if this means anything! Logs below.

    upload_2015-3-3_8-45-29.png

    RogueKiller V10.5.0.0 [Mar 2 2015] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 8.1 (6.3.9200 ) 64 bits version
    Started in : Normal mode
    User : Damien [Administrator]
    Mode : Delete -- Date : 03/03/2015 08:08:34

    ¤¤¤ Processes : 3 ¤¤¤
    [Suspicious.Path] nsk596B.tmpfs(1988) -- C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\nsk596B.tmpfs[-] -> Killed [TermProc]
    [Suspicious.Path] jnsi86BB.tmp(1528) -- C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\jnsi86BB.tmp[-] -> Killed [TermProc]
    [Suspicious.Path] RTFTrack.exe(4260) -- C:\Windows\RTFTrack.exe[7] -> Killed [TermProc]

    ¤¤¤ Registry : 17 ¤¤¤
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | RtsFT : RTFTrack.exe [7] -> Deleted
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\gibololy (C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\nsk596B.tmpfs) -> Not selected
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\jigezecu (C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\jnsi86BB.tmp) -> Not selected
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gibololy (C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\nsk596B.tmpfs) -> Not selected
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\jigezecu (C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\jnsi86BB.tmp) -> Not selected
    [PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1301979038-2669888510-292050220-1002\Software\Microsoft\Internet Explorer\Main | Start Page : http://lenovo13.msn.com/?pc=LCJB -> Not selected
    [PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1301979038-2669888510-292050220-1002\Software\Microsoft\Internet Explorer\Main | Start Page : http://lenovo13.msn.com/?pc=LCJB -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 194.168.4.100 194.168.8.100 [UNITED KINGDOM (GB)][UNITED KINGDOM (GB)] -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 194.168.4.100 194.168.8.100 [UNITED KINGDOM (GB)][UNITED KINGDOM (GB)] -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6F985CC1-0F22-4A73-8A60-CBCE57FCB320} | DhcpNameServer : 194.168.4.100 194.168.8.100 [UNITED KINGDOM (GB)][UNITED KINGDOM (GB)] -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DE4C76FE-658C-4D79-894F-BD37F2AFF35D} | DhcpNameServer : 194.168.4.100 194.168.8.100 [UNITED KINGDOM (GB)][UNITED KINGDOM (GB)] -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{6F985CC1-0F22-4A73-8A60-CBCE57FCB320} | DhcpNameServer : 194.168.4.100 194.168.8.100 [UNITED KINGDOM (GB)][UNITED KINGDOM (GB)] -> Not selected
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{DE4C76FE-658C-4D79-894F-BD37F2AFF35D} | DhcpNameServer : 194.168.4.100 194.168.8.100 [UNITED KINGDOM (GB)][UNITED KINGDOM (GB)] -> Not selected
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
    [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected

    ¤¤¤ Tasks : 4 ¤¤¤
    [Suspicious.Path] OAUOK.job -- C:\Users\Damien\AppData\Roaming\OAUOK.exe (/infocmdline=aNwn6wslRyBxOrwQDEqbW1if1xMd+Qh25fmZPw46ZJYUt69+tJ2xRP61nu8IPVXHeFnDakEQqFa8UkkXipBxHvN+/7fl5CTkU5Yvj5EfcZ9YHV1Xqv01sKb7tnzgypMPEjWkAGWC953b8aVPJtJ3T3iVR9O58+I5P2Oodf7dW40aRTasjJS2muN0nC5iY3ZYU8fztP5HMyBzFTzpnbOHqa+2ITkmBbHK/3b3lSBWQogFR33nx2nUQ/iPRfR7w+kW7q0LPfz9ARZHx3phTKDmtORzJeSOu0KYpiYKZOXe/W9BMLAROZ8VnnVkqBpUOq/Av1byNhqhPUKLT2mvaeW56loUevOerhSP4yh++S6/6+diYxkCyhuY1fr50uEKkPL8HPgrlO5XRhCXRwstEcLnTPOfCoU3RLhUOzQMMeq/elU9p5+a7C8l820rpv6aBrjUb39uaCIkTyfrE7z9L3WhePCWtM7lC2trCUbEdOoCrFKOdI/EYPjLNXS0BR3Zt1pl) -> Deleted
    [Suspicious.Path] REHXZDZS.job -- C:\Users\Damien\AppData\Roaming\REHXZDZS.exe (/infocmdline=cMHJqXXRGTsVBwidAb1YhDdT7NtzAaNWh3zo45p5e4B0qp5FWbdMqMkGu3o/mTmOrxbRrf9I/m2kgE7kQOpfngaHZTy1LjuwtTdn5wsCz8yNBEgtPH3Qi/btHUWoApmV65J8/Jkx4TT+21a23n5/R/QeNQ+lATTAzusnvHuKqao5Ymcggx+z/P39AZLUVfIz+6eC/o4pqz6ZnPHOt2ff4tsT26M0KvHgFwDYpod2EyagLTXmZypXnYXySs3fcIV0kadhSL3uhhsKgeUG7y8L43P2LjPRu4FG8Y3zQNYET0xoXRx5Ed2u6xBFtFXFxn1KNsbV7TWWIbhEpTRUjbFlhb4cQ1kv4N+jj9SfMKScxP5KB5IPdxKkgdWy9MJaPfsazqgybw8OpeaiyqHHPgKicEDfRbUwG5QHb7yeLM40oKI4MVUD3Ac9uQsb6lNdNVS8bI46kdD+HgNi85Ncptc6bVFYqzcQDxTegBKlgtH4W7qaHMSI0V+P7TV1yoVtGcItsZkLutK+wRg09MBTdV6esMVJAnVrHQ18v7KwLAnjHLQ6qygpZwcc4FRKmt288xLM80NNLghoNjL7A5LleUPNwEK91s0rHvKmd83SdnKb64/+DklNpVBvfiP1S7ufH9ZR3T06y0c1dfgiSyZsKto8dEXbr5D/fQu+D2xz3adWKyg=) -> Deleted
    [Suspicious.Path] \\OAUOK -- C:\Users\Damien\AppData\Roaming\OAUOK.exe (/infocmdline=aNwn6wslRyBxOrwQDEqbW1if1xMd+Qh25fmZPw46ZJYUt69+tJ2xRP61nu8IPVXHeFnDakEQqFa8UkkXipBxHvN+/7fl5CTkU5Yvj5EfcZ9YHV1Xqv01sKb7tnzgypMPEjWkAGWC953b8aVPJtJ3T3iVR9O58+I5P2Oodf7dW40aRTasjJS2muN0nC5iY3ZYU8fztP5HMyBzFTzpnbOHqa+2ITkmBbHK/3b3lSBWQogFR33nx2nUQ/iPRfR7w+kW7q0LPfz9ARZHx3phTKDmtORzJeSOu0KYpiYKZOXe/W9BMLAROZ8VnnVkqBpUOq/Av1byNhqhPUKLT2mvaeW56loUevOerhSP4yh++S6/6+diYxkCyhuY1fr50uEKkPL8HPgrlO5XRhCXRwstEcLnTPOfCoU3RLhUOzQMMeq/elU9p5+a7C8l820rpv6aBrjUb39uaCIkTyfrE7z9L3WhePCWtM7lC2trCUbEdOoCrFKOdI/EYPjLNXS0BR3Zt1pl) -> Deleted
    [Suspicious.Path] \\REHXZDZS -- C:\Users\Damien\AppData\Roaming\REHXZDZS.exe (/infocmdline=cMHJqXXRGTsVBwidAb1YhDdT7NtzAaNWh3zo45p5e4B0qp5FWbdMqMkGu3o/mTmOrxbRrf9I/m2kgE7kQOpfngaHZTy1LjuwtTdn5wsCz8yNBEgtPH3Qi/btHUWoApmV65J8/Jkx4TT+21a23n5/R/QeNQ+lATTAzusnvHuKqao5Ymcggx+z/P39AZLUVfIz+6eC/o4pqz6ZnPHOt2ff4tsT26M0KvHgFwDYpod2EyagLTXmZypXnYXySs3fcIV0kadhSL3uhhsKgeUG7y8L43P2LjPRu4FG8Y3zQNYET0xoXRx5Ed2u6xBFtFXFxn1KNsbV7TWWIbhEpTRUjbFlhb4cQ1kv4N+jj9SfMKScxP5KB5IPdxKkgdWy9MJaPfsazqgybw8OpeaiyqHHPgKicEDfRbUwG5QHb7yeLM40oKI4MVUD3Ac9uQsb6lNdNVS8bI46kdD+HgNi85Ncptc6bVFYqzcQDxTegBKlgtH4W7qaHMSI0V+P7TV1yoVtGcItsZkLutK+wRg09MBTdV6esMVJAnVrHQ18v7KwLAnjHLQ6qygpZwcc4FRKmt288xLM80NNLghoNjL7A5LleUPNwEK91s0rHvKmd83SdnKb64/+DklNpVBvfiP1S7ufH9ZR3T06y0c1dfgiSyZsKto8dEXbr5D/fQu+D2xz3adWKyg=) -> Deleted

    ¤¤¤ Files : 1 ¤¤¤
    [Suspicious.Path][File] 1AB16RN51.lnk -- C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1AB16RN51.lnk [LNK@] C:\ProgramData\{ce82ef32-0ad0-c1f0-ce82-2ef320adbcc8}\1AB16RN51.exe /startup -> Deleted

    ¤¤¤ Hosts File : 0 ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤

    ¤¤¤ Web browsers : 1 ¤¤¤
    [PUM.HomePage][FIREFX:Config] njojyi70.default-1425130353550 : user_pref("browser.startup.homepage", "http://www.bing.com/"); -> Not selected

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: ST1000LM024 HN-M101MBB +++++
    --- User ---
    [MBR] 456051f556dba0a28118a470ac9a9ac3
    [BSP] 11f4d0c854061b15e48d41065b2116ac : Empty MBR Code
    Partition table:
    0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 1000 MB
    1 - [SYSTEM][MAN-MOUNT] EFI system partition | Offset (sectors): 2050048 | Size: 260 MB
    2 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2582528 | Size: 1000 MB
    3 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 4630528 | Size: 128 MB
    4 - Basic data partition | Offset (sectors): 4892672 | Size: 910295 MB
    5 - Basic data partition | Offset (sectors): 1869176832 | Size: 25600 MB
    6 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 1921605632 | Size: 15585 MB
    User = LL1 ... OK
    User = LL2 ... OK


    ============================================
    RKreport_SCN_03032015_080009.log
     
    Last edited: Mar 3, 2015
  7. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    Malwarebytes Anti-Rootkit BETA 1.09.1.1004
    www.malwarebytes.org

    Database version:
    main: v2015.03.03.02
    rootkit: v2015.02.25.01

    Windows 8.1 x64 NTFS
    Internet Explorer 11.0.9600.17631
    Damien :: LENOVO-PC [administrator]

    03/03/2015 08:17:06
    mbar-log-2015-03-03 (08-17-06).txt

    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 447413
    Time elapsed: 17 minute(s), 6 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    Physical Sectors Detected: 0
    (No malicious items detected)

    (end)
     
  8. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.09.1.1004

    (c) Malwarebytes Corporation 2011-2012

    OS version: 6.3.9200 Windows 8.1 x64

    Account is Administrative

    Internet Explorer version: 11.0.9600.17631

    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
    CPU speed: 2.594000 GHz
    Memory total: 8476975104, free: 5398781952

    Downloaded database version: v2015.03.03.02
    Downloaded database version: v2015.02.25.01
    Downloaded database version: v2014.12.06.01
    Initializing...
    ======================
    This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.
    =======================================
    Initializing...
    This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.
    =======================================
    Initializing...
    ------------ Kernel report ------------
    03/03/2015 08:16:56
    ------------ Loaded modules -----------
    \SystemRoot\system32\ntoskrnl.exe
    \SystemRoot\system32\hal.dll
    \SystemRoot\system32\kd.dll
    \SystemRoot\system32\mcupdate_GenuineIntel.dll
    \SystemRoot\System32\drivers\werkernel.sys
    \SystemRoot\System32\drivers\CLFS.SYS
    \SystemRoot\System32\drivers\tm.sys
    \SystemRoot\system32\PSHED.dll
    \SystemRoot\system32\BOOTVID.dll
    \SystemRoot\system32\CI.dll
    \SystemRoot\System32\drivers\msrpc.sys
    \SystemRoot\system32\drivers\Wdf01000.sys
    \SystemRoot\system32\drivers\WDFLDR.SYS
    \SystemRoot\System32\Drivers\acpiex.sys
    \SystemRoot\System32\Drivers\WppRecorder.sys
    \SystemRoot\System32\drivers\ACPI.sys
    \SystemRoot\System32\drivers\WMILIB.SYS
    \SystemRoot\System32\Drivers\cng.sys
    \SystemRoot\System32\drivers\msisadrv.sys
    \SystemRoot\System32\drivers\pci.sys
    \SystemRoot\System32\drivers\vdrvroot.sys
    \SystemRoot\system32\drivers\pdc.sys
    \SystemRoot\System32\drivers\partmgr.sys
    \SystemRoot\System32\drivers\spaceport.sys
    \SystemRoot\System32\drivers\volmgr.sys
    \SystemRoot\System32\drivers\volmgrx.sys
    \SystemRoot\System32\drivers\mountmgr.sys
    \SystemRoot\System32\drivers\iaStorA.sys
    \SystemRoot\System32\drivers\storport.sys
    \SystemRoot\system32\drivers\fltmgr.sys
    \SystemRoot\System32\drivers\fileinfo.sys
    \SystemRoot\System32\Drivers\Wof.sys
    \SystemRoot\system32\drivers\WdFilter.sys
    \SystemRoot\System32\Drivers\Ntfs.sys
    \SystemRoot\System32\Drivers\ksecdd.sys
    \SystemRoot\System32\drivers\pcw.sys
    \SystemRoot\System32\Drivers\Fs_Rec.sys
    \SystemRoot\system32\drivers\ndis.sys
    \SystemRoot\system32\drivers\NETIO.SYS
    \SystemRoot\System32\Drivers\ksecpkg.sys
    \SystemRoot\System32\drivers\tcpip.sys
    \SystemRoot\System32\drivers\fwpkclnt.sys
    \SystemRoot\system32\DRIVERS\wfplwfs.sys
    \SystemRoot\System32\DRIVERS\fvevol.sys
    \SystemRoot\System32\drivers\volsnap.sys
    \SystemRoot\System32\drivers\rdyboost.sys
    \SystemRoot\System32\Drivers\mup.sys
    \SystemRoot\System32\drivers\intelpep.sys
    \SystemRoot\System32\drivers\disk.sys
    \SystemRoot\System32\drivers\CLASSPNP.SYS
    \SystemRoot\System32\Drivers\crashdmp.sys
    \SystemRoot\System32\drivers\cdrom.sys
    \SystemRoot\System32\Drivers\Null.SYS
    \SystemRoot\System32\Drivers\Beep.SYS
    \SystemRoot\System32\drivers\BasicRender.sys
    \SystemRoot\System32\drivers\dxgkrnl.sys
    \SystemRoot\System32\drivers\watchdog.sys
    \SystemRoot\System32\drivers\dxgmms1.sys
    \SystemRoot\System32\drivers\BasicDisplay.sys
    \SystemRoot\System32\Drivers\Npfs.SYS
    \SystemRoot\System32\Drivers\Msfs.SYS
    \SystemRoot\system32\DRIVERS\tdx.sys
    \SystemRoot\system32\DRIVERS\TDI.SYS
    \SystemRoot\System32\DRIVERS\netbt.sys
    \SystemRoot\system32\drivers\afd.sys
    \SystemRoot\system32\DRIVERS\pacer.sys
    \SystemRoot\system32\DRIVERS\vwififlt.sys
    \SystemRoot\system32\DRIVERS\netbios.sys
    \SystemRoot\system32\DRIVERS\rdbss.sys
    \SystemRoot\system32\drivers\nsiproxy.sys
    \SystemRoot\System32\drivers\npsvctrig.sys
    \SystemRoot\System32\drivers\mssmbios.sys
    \SystemRoot\System32\Drivers\dfsc.sys
    \SystemRoot\system32\DRIVERS\ahcache.sys
    \SystemRoot\System32\drivers\CompositeBus.sys
    \SystemRoot\system32\DRIVERS\kdnic.sys
    \SystemRoot\System32\drivers\umbus.sys
    \SystemRoot\system32\DRIVERS\igdkmd64.sys
    \SystemRoot\System32\drivers\HDAudBus.sys
    \SystemRoot\System32\drivers\USBXHCI.SYS
    \SystemRoot\System32\drivers\ucx01000.sys
    \SystemRoot\system32\DRIVERS\TeeDriverx64.sys
    \SystemRoot\system32\DRIVERS\Rt630x64.sys
    \SystemRoot\system32\DRIVERS\rtwlane.sys
    \SystemRoot\System32\drivers\vwifibus.sys
    \SystemRoot\system32\DRIVERS\nvlddmkm.sys
    \SystemRoot\System32\drivers\usbehci.sys
    \SystemRoot\System32\drivers\USBPORT.SYS
    \SystemRoot\System32\drivers\msgpiowin32.sys
    \SystemRoot\System32\drivers\CmBatt.sys
    \SystemRoot\System32\drivers\BATTC.SYS
    \SystemRoot\System32\drivers\AcpiVpc.sys
    \SystemRoot\System32\drivers\i8042prt.sys
    \SystemRoot\system32\DRIVERS\SynTP.sys
    \SystemRoot\system32\DRIVERS\USBD.SYS
    \SystemRoot\System32\drivers\kbdclass.sys
    \SystemRoot\System32\drivers\mouclass.sys
    \SystemRoot\system32\DRIVERS\Smb_driver_Intel.sys
    \SystemRoot\System32\drivers\wmiacpi.sys
    \SystemRoot\System32\drivers\intelppm.sys
    \SystemRoot\System32\drivers\NdisVirtualBus.sys
    \SystemRoot\System32\drivers\swenum.sys
    \SystemRoot\System32\drivers\ks.sys
    \SystemRoot\System32\drivers\iwdbus.sys
    \SystemRoot\System32\drivers\rdpbus.sys
    \SystemRoot\System32\drivers\usbhub.sys
    \SystemRoot\system32\DRIVERS\portcls.sys
    \SystemRoot\system32\DRIVERS\drmk.sys
    \SystemRoot\system32\drivers\ksthunk.sys
    \SystemRoot\System32\drivers\UsbHub3.sys
    \SystemRoot\system32\drivers\CHDRT64.sys
    \SystemRoot\System32\drivers\HIDCLASS.SYS
    \SystemRoot\System32\drivers\HIDPARSE.SYS
    \SystemRoot\System32\Drivers\RtsUVStor.sys
    \SystemRoot\System32\Drivers\fastfat.SYS
    \SystemRoot\System32\win32k.sys
    \SystemRoot\System32\TSDDD.dll
    \SystemRoot\System32\cdd.dll
    \SystemRoot\system32\drivers\luafv.sys
    \SystemRoot\system32\DRIVERS\lltdio.sys
    \SystemRoot\system32\DRIVERS\nwifi.sys
    \SystemRoot\system32\DRIVERS\ndisuio.sys
    \SystemRoot\system32\DRIVERS\rspndr.sys
    \SystemRoot\System32\Drivers\dump_diskdump.sys
    \SystemRoot\System32\Drivers\dump_iaStorA.sys
    \SystemRoot\System32\Drivers\dump_dumpfve.sys
    \SystemRoot\System32\drivers\monitor.sys
    \SystemRoot\System32\drivers\condrv.sys
    \SystemRoot\System32\drivers\usbccgp.sys
    \SystemRoot\system32\DRIVERS\RtkBtfilter.sys
    \SystemRoot\System32\Drivers\BTHUSB.sys
    \SystemRoot\System32\Drivers\bthport.sys
    \SystemRoot\system32\DRIVERS\rtsuvc.sys
    \SystemRoot\system32\drivers\HTTP.sys
    \SystemRoot\system32\DRIVERS\bowser.sys
    \SystemRoot\System32\drivers\mpsdrv.sys
    \SystemRoot\system32\DRIVERS\mrxsmb.sys
    \SystemRoot\system32\DRIVERS\mrxsmb20.sys
    \??\C:\windows\system32\drivers\aksdf.sys
    \SystemRoot\system32\DRIVERS\aksfridge.sys
    \SystemRoot\system32\DRIVERS\vwifimp.sys
    \SystemRoot\system32\DRIVERS\BthLEEnum.sys
    \SystemRoot\System32\drivers\rfcomm.sys
    \SystemRoot\System32\drivers\BthEnum.sys
    \SystemRoot\System32\drivers\bthpan.sys
    \??\C:\windows\system32\drivers\hardlock.sys
    \SystemRoot\system32\DRIVERS\mrxsmb10.sys
    \SystemRoot\system32\drivers\Ndu.sys
    \SystemRoot\system32\drivers\peauth.sys
    \SystemRoot\System32\Drivers\secdrv.SYS
    \SystemRoot\System32\DRIVERS\srvnet.sys
    \SystemRoot\System32\drivers\tcpipreg.sys
    \SystemRoot\System32\DRIVERS\srv2.sys
    \SystemRoot\System32\DRIVERS\srv.sys
    \SystemRoot\system32\DRIVERS\tunnel.sys
    \SystemRoot\system32\drivers\WudfPf.sys
    \SystemRoot\system32\DRIVERS\WUDFRd.sys
    \SystemRoot\System32\drivers\mshidumdf.sys
    \SystemRoot\system32\Drivers\WdNisDrv.sys
    \SystemRoot\System32\drivers\hidusb.sys
    \SystemRoot\System32\drivers\mouhid.sys
    \??\C:\windows\system32\drivers\mbamchameleon.sys
    \??\C:\windows\system32\drivers\MBAMSwissArmy.sys
    ----------- End -----------
    Done!

    Scan started
    Database versions:
    main: v2015.03.03.02
    rootkit: v2015.02.25.01

    <<<2>>>
    Physical Sector Size: 512
    Drive: 0, DevicePointer: 0xffffe000681f7060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
    --------- Disk Stack ------
    DevicePointer: 0xffffe000681f8400, DeviceName: Unknown, DriverName: \Driver\partmgr\
    DevicePointer: 0xffffe000681f7060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
    DevicePointer: 0xffffe000663910f0, DeviceName: Unknown, DriverName: \Driver\ACPI\
    DevicePointer: 0xffffe0006638e060, DeviceName: \Device\0000002d\, DriverName: \Driver\iaStorA\
    ------------ End ----------
    Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
    Upper DeviceData: 0x0, 0x0, 0x0
    Lower DeviceData: 0x0, 0x0, 0x0
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    <<<2>>>
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
    File "C:\Windows\System32\drivers\1394ohci.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\1394ohci.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\acpi.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\acpi.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\intelpep.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\intelpep.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\intelppm.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\intelppm.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\isapnp.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\isapnp.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\kbdclass.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\kbdclass.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\kbdhid.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\kbdhid.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\kdnic.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\kdnic.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\parport.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\parport.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\pci.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\pci.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\pciide.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\pciide.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\pciidex.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\pciidex.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\pcmcia.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\pcmcia.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\portcls.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\portcls.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\processr.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\processr.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\atapi.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\atapi.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\ataport.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\ataport.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\BasicDisplay.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\BasicDisplay.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\BasicRender.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\BasicRender.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\battc.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\battc.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\BtaMPM.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\BtaMPM.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\BthAvrcpTg.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\BthAvrcpTg.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\bthenum.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\bthenum.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\bthhfenum.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\bthhfenum.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\BthhfHid.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\BthhfHid.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\BthLEEnum.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\BthLEEnum.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\bthpan.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\bthpan.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\bthport.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\bthport.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\BTHUSB.SYS" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\BTHUSB.SYS" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\cdrom.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\cdrom.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\CmBatt.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\CmBatt.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\CompositeBus.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\CompositeBus.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\disk.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\disk.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\drmk.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\drmk.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\drmkaud.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\drmkaud.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\dumpsd.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\dumpsd.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\EhStorTcgDrv.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\EhStorTcgDrv.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\errdev.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\errdev.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\fdc.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\fdc.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\flpydisk.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\flpydisk.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\acpipagr.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\acpipagr.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\circlass.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\circlass.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\UCX01000.SYS" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\UCX01000.SYS" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\fxppm.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\fxppm.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\hdaudbus.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\hdaudbus.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\HdAudio.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\HdAudio.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\hidbatt.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\hidbatt.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\hidbth.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\hidbth.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\hidclass.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\hidclass.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\hidi2c.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\hidi2c.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\hidparse.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\hidparse.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\hidusb.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\hidusb.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\i8042prt.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\i8042prt.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\monitor.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\monitor.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\mouclass.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\mouclass.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\mouhid.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\mouhid.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\msgpiowin32.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\msgpiowin32.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\msisadrv.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\msisadrv.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\msiscsi.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\msiscsi.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\mssmbios.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\mssmbios.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\MTConfig.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\MTConfig.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\npsvctrig.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\npsvctrig.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\stornvme.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\stornvme.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\swenum.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\swenum.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\terminpt.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\terminpt.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\tpm.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\tpm.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\TsUsbGD.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\TsUsbGD.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\uaspstor.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\uaspstor.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\rdpbus.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\rdpbus.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\rfcomm.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\rfcomm.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\sbp2port.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\sbp2port.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\uefi.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\uefi.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\umbus.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\umbus.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\umpass.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\umpass.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\USBAUDIO.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\USBAUDIO.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\usbccgp.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\usbccgp.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\usbcir.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\usbcir.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\usbd.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\usbd.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\usbehci.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\usbehci.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\usbhub.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\usbhub.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\USBHUB3.SYS" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\USBHUB3.SYS" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\usbohci.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\usbohci.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\usbport.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\usbport.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\usbprint.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\usbprint.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\USBSTOR.SYS" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\USBSTOR.SYS" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\usbuhci.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\usbuhci.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\usbvideo.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\usbvideo.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\USBXHCI.SYS" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\USBXHCI.SYS" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\vdrvroot.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\vdrvroot.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\vhdmp.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\vhdmp.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\volmgr.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\volmgr.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\volsnap.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\volsnap.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\vwifibus.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\vwifibus.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\wacompen.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\wacompen.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\winusb.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\winusb.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\wmiacpi.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\wmiacpi.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\sdbus.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\sdbus.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\sdstor.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\sdstor.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\serenum.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\serenum.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\serial.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\serial.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\sermouse.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\sermouse.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\sfloppy.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\sfloppy.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\spaceport.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\spaceport.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\acpipmi.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\acpipmi.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\acpitime.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\acpitime.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\AGP440.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\AGP440.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\amdk8.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\amdk8.sys" is compressed (flags = 1)
    File "C:\Windows\System32\drivers\amdppm.sys" is compressed (flags = 1)
    File "C:\WINDOWS\SYSTEM32\drivers\amdppm.sys" is compressed (flags = 1)
    Done!
    Drive 0
    This is a System drive
    Scanning MBR on drive 0...
    Inspecting partition table:
    This drive is a GPT Drive.
    MBR Signature: 55AA
    Disk Signature: FBA667EC

    GPT Protective MBR Partition information:

    Partition 0 type is EFI-GPT (0xee)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 1 Numsec = 4294967295

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    GPT Partition information:

    GPT Header Signature 4546492050415254
    GPT Header Revision 65536 Size 92 CRC 3166843072
    GPT Header CurrentLba = 1 BackupLba 1953525167
    GPT Header FirstUsableLba 34 LastUsableLba 1953525134
    GPT Header Guid d80b78e6-5ea6-4cf9-a681-bba9f1c9fa5
    GPT Header Contains 128 partition entries starting at LBA 2
    GPT Header Partition entry size = 128

    Backup GPT header Signature 4546492050415254
    Backup GPT header Revision 65536 Size 92 CRC 3166843072
    Backup GPT header CurrentLba = 1953525167 BackupLba 1
    Backup GPT header FirstUsableLba 34 LastUsableLba 1953525134
    Backup GPT header Guid d80b78e6-5ea6-4cf9-a681-bba9f1c9fa5
    Backup GPT header Contains 128 partition entries starting at LBA 1953525135
    Backup GPT header Partition entry size = 128

    Partition 0 Type de94bba4-6d1-4d40-a16a-bfd5179d6ac
    Partition ID 9b15d852-bec9-469b-bbef-c0f51a9e4117
    FirstLBA 2048 Last LBA 2050047
    Attributes 1
    Partition Name Basic data partition

    Partition 1 Type c12a7328-f81f-11d2-ba4b-0a0c93ec93b
    Partition ID 5a7202e9-6f5f-4960-b128-e57235bfbd3e
    FirstLBA 2050048 Last LBA 2582527
    Attributes 1
    Partition Name EFI system partition

    GPT Partition 1 is bootable
    Partition 2 Type bfbfafe7-a34f-448a-9a5b-6213eb736c22
    Partition ID 51214578-60e1-45ad-893d-e86b1e6b7c71
    FirstLBA 2582528 Last LBA 4630527
    Attributes 1
    Partition Name Basic data partition

    Partition 3 Type e3c9e316-b5c-4db8-817d-f92df0215ae
    Partition ID 54d26de2-2f6c-4ade-9bea-7821c819c99d
    FirstLBA 4630528 Last LBA 4892671
    Attributes 0
    Partition Name Microsoft reserved partition

    Partition 4 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
    Partition ID a8d66cfe-649b-480e-a9b6-f498e0eb547f
    FirstLBA 4892672 Last LBA 1869176831
    Attributes 0
    Partition Name Basic data partition

    Partition 5 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
    Partition ID a1eb1bf1-39-4c02-b2c6-b45a641872b7
    FirstLBA 1869176832 Last LBA 1921605631
    Attributes 0
    Partition Name Basic data partition

    Partition 6 Type de94bba4-6d1-4d40-a16a-bfd5179d6ac
    Partition ID b3878ed4-30b4-4e4a-9ec9-b6d695c885c
    FirstLBA 1921605632 Last LBA 1953523711
    Attributes 1
    Partition Name Basic data partition

    Disk Size: 1000204886016 bytes
    Sector size: 512 bytes

    Done!
    Scan finished
    =======================================


    Removal queue found; removal started
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-I.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
    Removal finished
     
  9. Broni

    Broni Malware Annihilator Posts: 52,898   +344

    Pokki is actually a legit program which is used by many Windows 8 users: https://www.pokki.com/windows-8-start-menu
    It creates "Start" button menu similar to that in previous Windows versions. Windows 8 doesn't have such menu.
    If you don't like it see if you can uninstall it through Control Panel>Programs & Features.

    Aside from that we do have some infections present.

    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.

    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.

    [​IMG] Please download Farbar Recovery Scan Tool and save it to your Desktop.

    Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please copy and paste it to your reply.
     
  10. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    When I click my home button it opens C:\Users\Me\AppData\Roaming or the System32 folder and then the Pokki Menu tries to install/initiate.I have tried to uninstall Pokki Menu but it is not listed in the installed Program list. Hopefully the removal of all infections will fix it.

    upload_2015-3-4_7-59-18.png

    # AdwCleaner v4.111 - Logfile created 04/03/2015 at 06:54:18
    # Updated 18/02/2015 by Xplode
    # Database : 2015-03-02.3 [Server]
    # Operating system : Windows 8.1 (x64)
    # Username : Damien - LENOVO-PC
    # Running from : C:\Users\Damien\Desktop\adwcleaner_4.111(1).exe
    # Option : Cleaning

    ***** [ Services ] *****


    ***** [ Files / Folders ] *****

    Folder Deleted : C:\Program Files (x86)\Lenovo\VisualDiscovery
    File Deleted : C:\Users\Damien\Desktop\Continue Live Installation.lnk

    ***** [ Scheduled tasks ] *****


    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****

    Key Deleted : HKCU\Software\Pokki
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage

    ***** [ Web browsers ] *****

    -\\ Internet Explorer v11.0.9600.17416


    -\\ Mozilla Firefox v36.0 (x86 en-US)


    *************************

    AdwCleaner[R0].txt - [8316 bytes] - [02/03/2015 14:36:50]
    AdwCleaner[R1].txt - [1138 bytes] - [04/03/2015 06:52:32]
    AdwCleaner[S0].txt - [8382 bytes] - [02/03/2015 14:40:21]
    AdwCleaner[S1].txt - [1035 bytes] - [04/03/2015 06:54:18]

    ########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1094 bytes] ##########
     
  11. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 6.4.3 (03.01.2015:1)
    OS: Windows 8.1 x64
    Ran by Damien on 04/03/2015 at 7:20:52.77
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values



    ~~~ Registry Keys



    ~~~ Files



    ~~~ Folders



    ~~~ Event Viewer Logs were cleared





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on 04/03/2015 at 7:21:53.05
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
  12. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    FRST Log Attached due to character limit
     

    Attached Files:

  13. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-03-2015
    Ran by Damien at 2015-03-04 07:25:10
    Running from C:\Users\Damien\Desktop
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

    ==================== Installed Programs ======================

    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Lenovo Photo Master (HKLM-x32\...\InstallShield_{BC94C56A-3649-420C-8756-2ADEBE399D33}) (Version: 1.0.1823.01 - CyberLink Corp.)
    Lenovo Photo Master (x32 Version: 1.0.1823.01 - CyberLink Corp.) Hidden
    µTorrent (HKU\S-1-5-21-1301979038-2669888510-292050220-1002\...\uTorrent) (Version: 3.4.2.38758 - BitTorrent Inc.)
    Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
    Autodesk DWG TrueView 2015 - English (HKLM\...\DWG TrueView 2015 - English) (Version: 20.0.210.0 - Autodesk)
    Bluebeam PDF Revu x64 v6.5.4 (HKLM-x32\...\InstallShield_{B2F36211-EA94-4BC4-819C-25913C800E8A}) (Version: - )
    Bluebeam PDF Revu x64 v6.5.4 (Version: 6.5.4 - Bluebeam Software, Inc.) Hidden
    CEL-SoundTrack - dB23 (HKLM-x32\...\dB23) (Version: - )
    Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
    Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
    Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
    Cities of Earth 3D Screensaver v. 2.1 (HKLM-x32\...\Cities of Earth 3D Screensaver_is1) (Version: - Screenomania.com)
    CloudBerry Online Backup 4.0 (HKLM\...\CloudBerry Online Backup) (Version: 4.0 - CloudBerryLab)
    Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.65.28.50 - Conexant)
    CyberLink MediaStory (HKLM-x32\...\InstallShield_{55762F9A-FCE3-45d5-817B-051218658423}) (Version: 1.0.1314 - CyberLink Corp.)
    CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
    CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
    Dependency Package Update (Version: 1.6.25.00 - Lenovo Inc.) Hidden
    Dependency Package Update (Version: 1.6.29.00 - Lenovo Inc.) Hidden
    Dependency Package Update (Version: 1.6.32.00 - Lenovo Inc.) Hidden
    Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
    Dragon Assistant Application en-GB version 1.5.8 (HKLM-x32\...\{1CCBE73F-4948-4711-8D12-22E2FD65D706}_is1) (Version: 1.5.8 - Nuance Communications, Inc.)
    Dragon Assistant Core Recognition Service version 1.1.10 (HKLM-x32\...\{E97BA7A6-46FC-4EBF-B24A-B8362948C696}_is1) (Version: 1.1.10 - Nuance Communications, Inc.)
    Dragon Assistant Installer version 1.5.8 (HKLM-x32\...\{D57A8269-3BE5-4D10-B882-64D0F2D448BF}_is1) (Version: 1.5.8 - Nuance Communications, Inc.)
    Dragon Assistant Language Data en-GB version 1.1.3 (HKLM-x32\...\{CA54E6DD-70F8-4AE5-8427-522A52FC4408}_is1) (Version: 1.1.3 - Nuance Communications, Inc.)
    Dropbox (HKU\S-1-5-21-1301979038-2669888510-292050220-1002\...\Dropbox) (Version: 3.2.6 - Dropbox, Inc.)
    DWG TrueView 2015 - English (Version: 20.0.210.0 - Autodesk) Hidden
    Energy Manager (HKLM-x32\...\InstallShield_{AC768037-7079-4658-AC24-2897650E0ABE}) (Version: 1.0.0.35 - Lenovo)
    Energy Manager (x32 Version: 1.0.0.35 - Lenovo) Hidden
    EPSON WF-2510 Series Printer Uninstall (HKLM\...\EPSON WF-2510 Series) (Version: - SEIKO EPSON Corporation)
    Hightail for Lenovo (HKLM\...\{2F10E937-F6D7-4174-8AB9-B299E8FC5CEC}) (Version: 2.4.97.2857 - Hightail, Inc.)
    Insul80 (HKLM-x32\...\{7CB119C5-DA6E-4C7B-8BC6-DC231876F1F3}) (Version: 8.00.0000 - Marshall Day Acoustics)
    Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
    Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3379 - Intel Corporation)
    Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)
    Kingo ROOT version 1.3.3.2235 (HKLM-x32\...\{AE7675D6-0B31-494F-ABFA-822E1A0FDF17}_is1) (Version: 1.3.3.2235 - Kingosoft Technology Ltd.)
    Lenovo Dependency Package (HKLM\...\Lenovo Dependency Package_is1) (Version: 1.6.25.00 - Lenovo Group Limited)
    Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10249 - Realtek Semiconductor Corp.)
    Lenovo Experience Improvement (HKLM\...\LenovoExperienceImprovement) (Version: 1.0.19.0 - Lenovo)
    Lenovo FusionEngine (HKLM-x32\...\Lenovo FusionEngine) (Version: 1.0.13.0 - Lenovo, Inc.)
    Lenovo Mobile Phone Wireless Import (HKLM-x32\...\InstallShield_{DFB2E0D6-8DDE-49A4-B8F7-03C14DACCBA6}) (Version: 1.1.1.9 - Lenovo)
    Lenovo Mobile Phone Wireless Import (x32 Version: 1.1.1.9 - Lenovo) Hidden
    Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.2105 - CyberLink Corp.)
    Lenovo OneKey Recovery (Version: 8.0.0.2105 - CyberLink Corp.) Hidden
    Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.5630.52 - CyberLink Corp.)
    Lenovo PowerDVD10 (x32 Version: 10.0.5630.52 - CyberLink Corp.) Hidden
    Lenovo SHAREit (HKLM-x32\...\Lenovo SHAREit_is1) (Version: 2.0.5.0 - Lenovo Group Limited)
    Lenovo VeriFace (HKLM\...\Lenovo VeriFace) (Version: 5.0.13.5261 - Lenovo)
    Lenovo Web Start (HKU\S-1-5-21-1301979038-2669888510-292050220-1002\...\Pokki_04bb6df446330549a2cb8d67fbd1a745025b7bd1) (Version: 1.0.2.53457 - Pokki)
    Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
    MetaTrader 4 (HKLM-x32\...\MetaTrader 4) (Version: 4.00 - MetaQuotes Software Corp.)
    Metric Collection SDK 35 (x32 Version: 1.2.0001.00 - Lenovo Group Limited) Hidden
    Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4693.1002 - Microsoft Corporation)
    Microsoft OneDrive (HKU\S-1-5-21-1301979038-2669888510-292050220-1002\...\OneDriveSetup.exe) (Version: 17.3.1171.0714 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
    Mozilla Firefox 36.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 36.0 (x86 en-US)) (Version: 36.0 - Mozilla)
    Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0.1 - Mozilla)
    Nitro Pro 9 (HKLM\...\{70B831B7-A8EE-4C5F-8F34-F383D24B3A04}) (Version: 9.0.5.9 - Nitro)
    Norsonic NorXfer 5.0 (HKLM-x32\...\{3DBF2352-DFCE-4F67-80AE-D7864B0DE827}) (Version: 5.0 - Norsonic)
    NVIDIA GeForce Experience 1.7 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.7 - NVIDIA Corporation)
    NVIDIA Graphics Driver 332.33 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 332.33 - NVIDIA Corporation)
    NVIDIA PhysX System Software 9.13.0927 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0927 - NVIDIA Corporation)
    Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4693.1002 - Microsoft Corporation) Hidden
    Office 15 Click-to-Run Licensing Component (Version: 15.0.4693.1002 - Microsoft Corporation) Hidden
    Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4693.1002 - Microsoft Corporation) Hidden
    Onekey Theater (HKLM-x32\...\{91CC5BAE-A098-40D3-A43B-C0DC7CE263FE}) (Version: 3.0.1.2 - Lenovo)
    Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.10525 - CyberLink Corp.)
    REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.805.802.010814 - REALTEK Semiconductor Corp.)
    Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.39052 - Realtek Semiconductor Corp.)
    Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek)
    REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0238 - REALTEK Semiconductor Corp.)
    SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.24.0 - SAMSUNG Electronics Co., Ltd.)
    Skype™ 7.1 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
    Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
    StageLight (HKLM\...\StageLight) (Version: 1.3.0.4350 - Open Labs, LLC.)
    Start Menu (HKU\S-1-5-21-1301979038-2669888510-292050220-1002\...\Pokki_Start_Menu) (Version: 0.269.6.102 - Pokki)
    Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.14.74 - Synaptics Incorporated)
    TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.39052 - TeamViewer)
    User Manuals (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 3.0.0.3 - Lenovo)
    User Manuals (x32 Version: 3.0.0.3 - Lenovo) Hidden
    Windows Driver Package - Lenovo (ACPIVPC) System (02/17/2013 9.52.0.776) (HKLM\...\35DD26BE48DAF4A9F35F969F3CB1E3E1435E661E) (Version: 02/17/2013 9.52.0.776 - Lenovo)
    Windows Driver Package - Lenovo (WUDFRd) LenovoVhid (07/25/2013 10.30.0.288) (HKLM\...\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)
    WinZip 15.0 (HKLM-x32\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240BE}) (Version: 15.0.9302 - WinZip Computing, S.L. )

    ==================== Custom CLSID (selected items): ==========================

    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

    CustomCLSID: HKU\S-1-5-21-1301979038-2669888510-292050220-1002_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Damien\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1301979038-2669888510-292050220-1002_Classes\CLSID\{149DD748-EA85-45A6-93C5-AC50D0260C98}\localserver32 -> C:\Program Files\Autodesk\DWG TrueView 2015 - English\dwgviewr.exe (Autodesk, Inc.)
    CustomCLSID: HKU\S-1-5-21-1301979038-2669888510-292050220-1002_Classes\CLSID\{3faa4380-a399-11cf-a466-00805fe418f6}\InprocServer32 -> C:\Program Files\Autodesk\DWG TrueView 2015 - English\en-US\dwgviewrficn.dll (Autodesk, Inc.)
    CustomCLSID: HKU\S-1-5-21-1301979038-2669888510-292050220-1002_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1301979038-2669888510-292050220-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Damien\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64\FileSyncApi64.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-1301979038-2669888510-292050220-1002_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1301979038-2669888510-292050220-1002_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1301979038-2669888510-292050220-1002_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1301979038-2669888510-292050220-1002_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1301979038-2669888510-292050220-1002_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1301979038-2669888510-292050220-1002_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1301979038-2669888510-292050220-1002_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-1301979038-2669888510-292050220-1002_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

    ==================== Restore Points =========================

    23-02-2015 10:15:25 Scheduled Checkpoint
    03-03-2015 02:45:58 Scheduled Checkpoint
    03-03-2015 08:13:05 R1

    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2013-08-22 13:25 - 2013-08-22 13:25 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

    ==================== Scheduled Tasks (whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

    Task: {0B57303A-8F2F-402A-9770-576F1F38F305} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1301979038-2669888510-292050220-1002 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe
    Task: {24944B3E-4CE8-4BEB-ADE3-6A8F1C86242A} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-15] (Adobe Systems Incorporated)
    Task: {334600DB-3649-43D6-BD46-0338026E79D6} - System32\Tasks\Lenovo\Experience Improvement => C:\Program Files\Lenovo\ExperienceImprovement\LenovoExperienceImprovement.exe [2015-02-15] (Lenovo)
    Task: {3740592F-86C7-4C75-A538-64889CEEFB72} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2014-05-30] (Lenovo)
    Task: {3A5756A9-1F15-44BD-908F-E70F54BA59EE} - System32\Tasks\Lenovo\Dependency Package Auto Update => C:\Program Files\Lenovo\iMController\AutoUpdate.exe [2014-05-22] ()
    Task: {3AA2E6E0-DB0B-458C-9345-48FECAF2BFB3} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-12-30] (Microsoft Corporation)
    Task: {594451AE-828E-40E7-9562-F88A4448B10A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
    Task: {76BAAA1E-7F86-446B-81FC-64F005070D5C} - System32\Tasks\Microsoft Office 15 Sync Maintenance for LENOVO-PC-Damien Lenovo-PC => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-02-16] (Microsoft Corporation)
    Task: {850079EE-8001-437A-B6A3-7024A284044D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
    Task: {85A49FC2-7C8D-4EBC-9DE7-E0B2A4694D30} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2015-01-29] (Microsoft Corporation)
    Task: {B64D4623-C3D1-41EC-8FD0-4440E8BE5EEB} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-12-24] (Synaptics Incorporated)
    Task: {B75AC203-E6A5-4C5D-B31C-866F9A732D2F} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-12-30] (Microsoft Corporation)
    Task: {E1E0FEAB-E18A-40D4-AEE2-DEB871332C82} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-02-16] (Microsoft Corporation)
    Task: {F37812F7-F3CA-455F-9535-5F934B57CD59} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
    Task: {F44DEE37-64D0-4C3C-B345-BBD42D3419C2} - System32\Tasks\PDVDServ Task => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.EXE [2013-03-08] (CyberLink Corp.)
    Task: {FA374CE2-2409-44B6-A86E-ADDBA9D0A205} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
    Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

    ==================== Loaded Modules (whitelisted) ==============

    2014-08-17 15:24 - 2014-01-06 08:13 - 00117536 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
    2014-08-17 15:32 - 2014-01-06 21:56 - 00079872 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe
    2015-02-16 10:33 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
    2015-01-16 08:45 - 2015-01-16 08:45 - 00941568 _____ () C:\Program Files (x86)\CloudBerryLab\CloudBerry Online Backup\CloudBerryLab.Backup.Engine.XmlSerializers.dll
    2015-02-27 18:27 - 2015-02-27 18:27 - 00123904 _____ () C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\nsk596B.tmpfs
    2015-02-27 18:27 - 2015-02-27 18:27 - 00108032 _____ () C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\jnsi86BB.tmp
    2014-08-17 16:12 - 2012-04-24 10:43 - 00390632 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
    2014-08-17 16:15 - 2014-08-17 16:15 - 00068368 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
    2014-08-17 16:15 - 2014-08-17 16:15 - 00669288 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfDataStorageInterface.dll
    2014-08-17 15:38 - 2010-10-26 04:40 - 00049056 _____ () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
    2015-02-16 10:36 - 2015-02-16 10:36 - 08898728 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
    2014-08-17 16:13 - 2013-05-02 18:26 - 00387984 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\fl_core.dll
    2014-08-17 16:13 - 2013-05-02 18:26 - 01165712 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\vocon3200_asr.dll
    2014-08-17 16:13 - 2013-05-02 18:26 - 00199056 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\vocon3200_base.dll
    2014-08-17 16:13 - 2013-05-02 18:26 - 01132944 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\vocon3200_pron.dll
    2014-08-17 16:13 - 2013-05-02 18:26 - 00035216 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\vocon3200_platform.dll
    2014-08-17 16:13 - 2013-05-02 18:26 - 00229264 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\sdxg.dll
    2014-08-17 16:13 - 2013-05-02 18:25 - 00027648 _____ () C:\Program Files (x86)\Nuance\Dragon Assistant\Core\WASAPIResamplingStreamCOMServer.dll
    2015-02-27 20:41 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
    2015-02-27 20:41 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
    2015-02-27 20:41 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
    2015-02-27 20:41 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
    2015-02-27 20:41 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
    2015-02-16 10:33 - 2015-02-16 10:33 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll
    2015-02-16 10:34 - 2015-02-16 10:36 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
    2014-08-17 15:29 - 2013-09-16 19:20 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

    ==================== Alternate Data Streams (whitelisted) =========

    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

    AlternateDataStreams: C:\windows\system32\Drivers\lpqsidom.sys:changelist
    AlternateDataStreams: C:\Users\Damien\OneDrive:ms-properties

    ==================== Safe Mode (whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VDWFP => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VisualDiscovery => ""="service"

    ==================== EXE Association (whitelisted) ===============

    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-1301979038-2669888510-292050220-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Damien\Pictures\Snowdon Sept 14\20140907_132227.jpg
    DNS Servers: 194.168.4.100 - 194.168.8.100

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-1301979038-2669888510-292050220-1002\...\StartupApproved\StartupFolder: => "Dropbox.lnk"

    ==================== Accounts: =============================

    Administrator (S-1-5-21-1301979038-2669888510-292050220-500 - Administrator - Disabled)
    Damien (S-1-5-21-1301979038-2669888510-292050220-1002 - Administrator - Enabled) => C:\Users\Damien
    Damien_2 (S-1-5-21-1301979038-2669888510-292050220-1003 - Limited - Enabled) => C:\Users\Damien_2
    Guest (S-1-5-21-1301979038-2669888510-292050220-501 - Limited - Disabled)
    UpdatusUser (S-1-5-21-1301979038-2669888510-292050220-1001 - Limited - Enabled) => C:\Users\UpdatusUser

    ==================== Faulty Device Manager Devices =============


    ==================== Event log errors: =========================

    Application errors:
    ==================

    System errors:
    =============
    Error: (03/04/2015 07:25:21 AM) (Source: DCOM) (EventID: 10010) (User: LENOVO-PC)
    Description: {9AA46009-3CE0-458A-A354-715610A075E6}

    Error: (03/04/2015 07:24:51 AM) (Source: DCOM) (EventID: 10010) (User: LENOVO-PC)
    Description: {9AA46009-3CE0-458A-A354-715610A075E6}

    Error: (03/04/2015 07:24:21 AM) (Source: DCOM) (EventID: 10010) (User: LENOVO-PC)
    Description: {9AA46009-3CE0-458A-A354-715610A075E6}


    Microsoft Office Sessions:
    =========================

    CodeIntegrity Errors:
    ===================================
    Date: 2015-03-03 02:25:14.741
    Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2015-02-28 07:14:16.454
    Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2015-02-24 08:07:09.028
    Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2015-02-20 08:02:46.987
    Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2015-02-18 07:33:22.070
    Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2015-02-16 03:06:45.195
    Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2015-02-16 03:06:44.570
    Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

    Date: 2015-02-15 19:20:37.262
    Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Norsonic\NorXfer\FastLynx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    Date: 2015-02-15 14:30:36.102
    Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Norsonic\NorXfer\FastLynx.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM) i7-4510U CPU @ 2.00GHz
    Percentage of memory in use: 22%
    Total physical RAM: 8084.27 MB
    Available physical RAM: 6261.96 MB
    Total Pagefile: 9364.27 MB
    Available Pagefile: 7568.43 MB
    Total Virtual: 131072 MB
    Available Virtual: 131071.79 MB

    ==================== Drives ================================

    Drive c: (Windows8_OS) (Fixed) (Total:888.96 GB) (Free:816.1 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:22.69 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 931.5 GB) (Disk ID: FBA667EC)

    Partition: GPT Partition Type.

    ==================== End Of Log ============================
     
  14. Broni

    Broni Malware Annihilator Posts: 52,898   +344

    All logs have to be pasted not attached.
    Use multiple replies if needed.
     
  15. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-03-2015
    Ran by Damien (administrator) on LENOVO-PC on 04-03-2015 07:24:25
    Running from C:\Users\Damien\Desktop
    Loaded Profiles: UpdatusUser & Damien (Available profiles: UpdatusUser & Damien & Damien_2)
    Platform: Windows 8.1 (X64) OS Language: English (United States)
    Internet Explorer Version 11 (Default browser: FF)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (Microsoft Corporation) C:\Windows\System32\wlanext.exe
    () C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
    (CloudBerry Lab Inc.) C:\Program Files (x86)\CloudBerryLab\CloudBerry Online Backup\CloudBerry.Backup.Scheduler.exe
    (Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
    (Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\Dragon Assistant\Core\DACore.exe
    (Microsoft Corporation) C:\Windows\System32\dasHost.exe
    () C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\nsk596B.tmpfs
    (SafeNet Inc.) C:\Windows\System32\hasplms.exe
    (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
    () C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\jnsi86BB.tmp
    (LENOVO INCORPORATED.) C:\Program Files\lenovo\iMController\SystemAgentService.exe
    (Lenovo(beijing) Limited) C:\Windows\System32\LenovoWiFiHotspotSvr.exe
    (Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
    (Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
    () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
    (Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
    (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
    () C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
    (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
    (Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe
    (Intel Corporation) C:\Windows\System32\igfxtray.exe
    (Intel Corporation) C:\Windows\System32\igfxsrvc.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
    (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
    () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
    (Lenovo) C:\Program Files\lenovo\Onekey Theater\OnekeyStudio.exe
    (Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
    (Bluebeam Software, Inc.) C:\Program Files\Common Files\Bluebeam Software\Brewery\V45\Printer Support\BBPrint.exe
    (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIIXE.EXE
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
    (CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
    (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
    (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
    (Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-10-17] (NVIDIA Corporation)
    HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
    HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [216064 2014-01-06] (Realtek Semiconductor Corporation)
    HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [907480 2013-09-05] (Conexant Systems, Inc.)
    HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
    HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
    HKLM\...\Run: [OnekeyStudio] => C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe [4196432 2012-09-14] (Lenovo)
    HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-08-17] (Lenovo(beijing) Limited)
    HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-08-17] (Lenovo(beijing) Limited)
    HKLM\...\Run: [BbPrintMonitor] => C:\Program Files\Common Files\Bluebeam Software\Brewery\V45\Printer Support\BBPrint.exe [211616 2008-01-15] (Bluebeam Software, Inc.)
    HKLM\...\Run: [BbInstallUser] => C:\Program Files\Bluebeam Software\Pushbutton PDF\Bluebeam Admin User.exe [49824 2008-11-25] (Bluebeam Software, Inc.)
    HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-07] (CyberLink Corp.)
    HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
    Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
    Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
    HKU\S-1-5-21-1301979038-2669888510-292050220-1002\...\Run: [EPLTarget\P0000000000000000] => C:\windows\system32\spool\DRIVERS\x64\3\E_YATIIXE.EXE [283232 2015-01-07] (SEIKO EPSON CORPORATION)
    HKU\S-1-5-21-1301979038-2669888510-292050220-1002\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\system32\Cities.scr
    Startup: C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
    ShortcutTarget: Dropbox.lnk -> C:\Users\Damien\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
    ShellIconOverlayIdentifiers: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
    ShellIconOverlayIdentifiers: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
    ShellIconOverlayIdentifiers: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
    ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\windows\system32\AcSignIcon.dll (Autodesk, Inc.)
    ShellIconOverlayIdentifiers-x32: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
    ShellIconOverlayIdentifiers-x32: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
    ShellIconOverlayIdentifiers-x32: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
    ShellIconOverlayIdentifiers-x32: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
    BootExecute: autocheck autochk * sdnclean64.exe

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKU\S-1-5-21-1301979038-2669888510-292050220-1002\Software\Microsoft\Internet Explorer\Main,Start Page = http://lenovo13.msn.com/?pc=LCJB
    HKU\S-1-5-21-1301979038-2669888510-292050220-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com/?pc=LCJB
    HKU\S-1-5-21-1301979038-2669888510-292050220-1002\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com
    HKU\S-1-5-21-1301979038-2669888510-292050220-1002\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.lenovo.com
    URLSearchHook: [S-1-5-21-1301979038-2669888510-292050220-1001] ATTENTION ==> Default URLSearchHook is missing.
    SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-1301979038-2669888510-292050220-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
    BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
    Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
    Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    Tcpip\Parameters: [DhcpNameServer] 194.168.4.100 194.168.8.100

    FireFox:
    ========
    FF ProfilePath: C:\Users\Damien\AppData\Roaming\Mozilla\Firefox\Profiles\njojyi70.default-1425130353550
    FF Homepage: hxxp://www.bing.com/
    FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
    FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll (Nitro PDF)
    FF Extension: Firefox Certificate Store Hotfix - C:\Users\Damien\AppData\Roaming\Mozilla\Firefox\Profiles\njojyi70.default-1425130353550\Extensions\firefox-hotfix@mozilla.org.xpi [2015-02-28]
    FF Extension: Adblock Plus - C:\Users\Damien\AppData\Roaming\Mozilla\Firefox\Profiles\njojyi70.default-1425130353550\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-02-28]

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [79872 2014-01-06] () [File not signed]
    R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2711736 2015-01-13] (Microsoft Corporation)
    R2 CloudBerry Backup Service; C:\Program Files (x86)\CloudBerryLab\CloudBerry Online Backup\CloudBerry.Backup.Scheduler.exe [69928 2015-01-16] (CloudBerry Lab Inc.)
    R2 DACoreService; C:\Program Files (x86)\Nuance\Dragon Assistant\Core\DACore.exe [432528 2013-05-02] (Nuance Communications, Inc.)
    R2 hasplms; C:\Windows\system32\hasplms.exe [4608320 2014-11-26] (SafeNet Inc.)
    R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
    R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
    S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
    R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
    R2 jigezecu; C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\jnsi86BB.tmp [108032 2015-02-27] () [File not signed]
    S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [533760 2014-06-03] (Lenovo)
    R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-05-22] (LENOVO INCORPORATED.)
    R2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [198192 2014-08-17] (Lenovo(beijing) Limited)
    R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-13] (Nitro PDF Software)
    S3 NorServer.Std; C:\Program Files (x86)\Norsonic\NorXfer\norsrv.exe [1940480 2012-06-19] (Norsonic AS) [File not signed]
    R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
    R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
    R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
    R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
    R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5436176 2015-02-17] (TeamViewer GmbH)
    R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2014-08-17] ()
    S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
    R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
    R2 gibololy; C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\nsk596B.tmpfs [X]

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    S3 akshasp; C:\Windows\system32\DRIVERS\akshasp.sys [60488 2014-11-26] (SafeNet Inc.)
    S3 akshhl; C:\Windows\system32\DRIVERS\akshhl.sys [63944 2014-11-26] (SafeNet Inc.)
    S3 aksusb; C:\Windows\system32\DRIVERS\aksusb.sys [303624 2014-11-26] (SafeNet Inc.)
    R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
    S3 FastLynx; C:\Program Files (x86)\Norsonic\NorXfer\FastLynx.sys [5036 1999-10-29] () [File not signed]
    R2 hardlock; C:\windows\system32\drivers\hardlock.sys [331608 2014-11-26] (SafeNet Inc.)
    R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
    S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
    R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [558296 2014-01-05] (Realtek Semiconductor Corporation)
    R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [8876248 2013-10-17] (Realtek Semiconductor Corp.)
    R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2982104 2013-12-26] (Realtek Semiconductor Corporation )
    R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-12-24] (Synaptics Incorporated)
    U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-03-03] ()
    S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
    S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-14] ("CyberLink)

    ==================== NetSvcs (Whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-03-04 07:24 - 2015-03-04 07:24 - 00019078 _____ () C:\Users\Damien\Desktop\FRST.txt
    2015-03-04 07:24 - 2015-03-04 07:24 - 00000000 ____D () C:\FRST
    2015-03-04 07:23 - 2015-03-04 07:23 - 02092544 _____ (Farbar) C:\Users\Damien\Desktop\FRST64.exe
    2015-03-04 07:21 - 2015-03-04 07:21 - 00000615 _____ () C:\Users\Damien\Desktop\JRT.txt
    2015-03-04 07:12 - 2015-03-04 07:12 - 01388333 _____ (Thisisu) C:\Users\Damien\Desktop\JRT(1).exe
    2015-03-04 06:57 - 2015-03-04 06:57 - 00001174 _____ () C:\Users\Damien\Desktop\AdwCleaner[S1].txt
    2015-03-04 06:52 - 2015-03-04 06:42 - 02126848 _____ () C:\Users\Damien\Desktop\adwcleaner_4.111(1).exe
    2015-03-04 06:42 - 2015-03-04 06:42 - 02126848 _____ () C:\Users\Damien\Downloads\adwcleaner_4.111(1).exe
    2015-03-03 16:09 - 2015-03-04 00:47 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\TeamViewer
    2015-03-03 16:09 - 2015-03-03 16:09 - 00001066 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
    2015-03-03 16:09 - 2015-03-03 16:09 - 00001054 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk
    2015-03-03 16:09 - 2015-03-03 16:09 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
    2015-03-03 16:08 - 2015-03-03 16:08 - 07782048 _____ (TeamViewer GmbH) C:\Users\Damien\Downloads\TeamViewer_Setup_en.exe
    2015-03-03 09:25 - 2015-03-03 09:25 - 00000000 ____D () C:\Users\Damien\AppData\Local\CrashDumps
    2015-03-03 08:16 - 2015-03-03 08:36 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2015-03-03 08:14 - 2015-03-03 08:36 - 00000000 ____D () C:\Users\Damien\Desktop\mbar
    2015-03-03 08:13 - 2015-03-03 08:13 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Damien\Desktop\mbar-1.09.1.1004.exe
    2015-03-03 08:08 - 2015-03-03 08:08 - 00008506 _____ () C:\Users\Damien\Desktop\RKreport_DEL_03032015_080834.log
    2015-03-03 07:52 - 2015-03-03 08:08 - 00000000 ____D () C:\ProgramData\RogueKiller
    2015-03-03 07:52 - 2015-03-03 07:52 - 00035064 _____ () C:\windows\system32\Drivers\TrueSight.sys
    2015-03-03 07:48 - 2015-03-03 07:48 - 15566936 _____ () C:\Users\Damien\Desktop\RogueKiller.exe
    2015-03-02 22:33 - 2015-03-04 00:09 - 00000000 ____D () C:\Users\Damien\Downloads\Game.Of.Thrones.Season.1-4.Complete.720p.x264-ILPruny
    2015-03-02 17:04 - 2015-03-02 17:02 - 00688992 _____ (Swearware) C:\Users\Damien\Desktop\dds.com
    2015-03-02 17:02 - 2015-03-02 17:02 - 00688992 _____ (Swearware) C:\Users\Damien\Downloads\dds.com
    2015-03-02 17:01 - 2015-03-02 17:01 - 00016741 _____ () C:\Users\Damien\Desktop\27_02_15 Scan 1.txt
    2015-03-02 17:01 - 2015-03-02 17:01 - 00001274 _____ () C:\Users\Damien\Desktop\27_02_15 Scan 2.txt
    2015-03-02 17:00 - 2015-03-02 17:00 - 00001184 _____ () C:\Users\Damien\Desktop\02_03_15 Scan.txt
    2015-03-02 16:14 - 2015-03-04 06:57 - 00000273 _____ () C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pokki Menu.lnk
    2015-03-02 15:05 - 2015-03-02 15:05 - 01388333 _____ (Thisisu) C:\Users\Damien\Downloads\JRT.exe
    2015-03-02 14:35 - 2015-03-04 06:54 - 00000000 ____D () C:\AdwCleaner
    2015-03-02 14:35 - 2015-03-02 14:35 - 02126848 _____ () C:\Users\Damien\Downloads\adwcleaner_4.111.exe
    2015-03-02 09:02 - 2015-03-02 09:10 - 00000000 ____D () C:\Users\Damien\Downloads\yellow-icon
    2015-03-02 09:02 - 2015-03-02 09:02 - 00100254 _____ () C:\Users\Damien\Downloads\yellow-icon.zip
    2015-02-28 13:32 - 2015-02-28 13:32 - 00000000 ____D () C:\Users\Damien\Desktop\Old Firefox Data
    2015-02-27 20:48 - 2015-02-27 20:48 - 00000000 ____D () C:\Users\Damien\Documents\ProcAlyzer Dumps
    2015-02-27 20:42 - 2015-02-27 20:42 - 00001414 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
    2015-02-27 20:42 - 2015-02-27 20:42 - 00001402 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
    2015-02-27 20:42 - 2015-02-27 20:42 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
    2015-02-27 20:42 - 2015-02-27 20:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
    2015-02-27 20:41 - 2015-02-27 21:06 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
    2015-02-27 20:41 - 2015-02-27 20:44 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
    2015-02-27 20:41 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\windows\system32\sdnclean64.exe
    2015-02-27 20:39 - 2015-02-27 20:41 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Damien\Downloads\spybot-2.4.exe
    2015-02-27 19:36 - 2015-02-27 19:36 - 00628504 _____ (CMI Limited) C:\Users\Damien\AppData\Local\nsuDDF9.tmp
    2015-02-27 19:29 - 2015-02-27 19:29 - 00000000 ____H () C:\windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
    2015-02-27 19:29 - 2015-02-27 19:29 - 00000000 ____D () C:\windows\LastGood.Tmp
    2015-02-27 19:28 - 2015-02-27 19:29 - 00000000 ____D () C:\Users\Damien\.android
    2015-02-27 19:28 - 2015-02-27 19:28 - 00000000 ____D () C:\ProgramData\Samsung
    2015-02-27 19:28 - 2015-02-27 19:28 - 00000000 ____D () C:\Program Files\SAMSUNG
    2015-02-27 19:28 - 2013-05-02 04:23 - 01490656 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01007.dll
    2015-02-27 19:28 - 2013-05-02 04:23 - 00708168 _____ (Microsoft Corporation) C:\windows\system32\WinUSBCoInstaller.dll
    2015-02-27 19:23 - 2015-02-27 19:24 - 00000000 ____D () C:\Program Files (x86)\Kingo ROOT
    2015-02-27 19:23 - 2015-02-27 19:23 - 00001054 _____ () C:\Users\Public\Desktop\Kingo ROOT.lnk
    2015-02-27 19:23 - 2015-02-27 19:23 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Kingosoft
    2015-02-27 19:23 - 2015-02-27 19:23 - 00000000 ____D () C:\Users\Damien\AppData\Local\Kingosoft
    2015-02-27 19:23 - 2015-02-27 19:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kingo ROOT
    2015-02-27 19:18 - 2015-02-27 19:19 - 18645056 _____ (Kingosoft Technology Ltd. ) C:\Users\Damien\Downloads\android_root.exe
    2015-02-27 18:57 - 2015-02-27 18:57 - 00000000 __SHD () C:\Users\Damien\AppData\Local\EmieBrowserModeList
    2015-02-27 18:52 - 2015-03-03 08:16 - 00136408 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
    2015-02-27 18:52 - 2015-03-03 08:14 - 00107736 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
    2015-02-27 18:52 - 2015-02-27 18:52 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2015-02-27 18:52 - 2015-02-27 18:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2015-02-27 18:52 - 2015-02-27 18:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
    2015-02-27 18:52 - 2015-02-27 18:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
    2015-02-27 18:52 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
    2015-02-27 18:52 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
    2015-02-27 18:49 - 2015-02-27 18:50 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Damien\Downloads\mbam-setup-2.0.4.1028.exe
    2015-02-27 18:36 - 2015-02-27 18:36 - 00000000 _____ () C:\autoexec.bat
    2015-02-27 18:33 - 2015-02-27 18:33 - 03109248 _____ (Enigma Software Group USA, LLC.) C:\Users\Damien\Downloads\SpyHunter-Installer.exe
    2015-02-27 18:32 - 2015-02-27 18:33 - 00001681 _____ () C:\windows\SysWOW64\${LOGFILE}
    2015-02-27 18:28 - 2015-02-27 18:33 - 00000000 ____D () C:\Users\Damien\AppData\Local\95A7E375-1425061680-11E4-A818-28D244D31727
    2015-02-27 18:27 - 2015-03-02 16:10 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727
    2015-02-27 18:27 - 2015-02-27 18:27 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Nitro PDF
    2015-02-27 18:25 - 2015-02-27 19:19 - 00000000 ____D () C:\ProgramData\{ce82ef32-0ad0-c1f0-ce82-2ef320adbcc8}
    2015-02-27 18:03 - 2015-02-27 18:16 - 00000000 ____D () C:\Users\Damien\Documents\Galaxy S3 Backup
    2015-02-27 12:37 - 2015-02-27 12:37 - 00000000 ____D () C:\ProgramData\MetaQuotes
    2015-02-27 12:36 - 2015-02-27 12:36 - 04441216 _____ (MetaQuotes Software Corp.) C:\windows\system32\MetaViewer64.dll
    2015-02-27 12:36 - 2015-02-27 12:36 - 00001944 _____ () C:\Users\Public\Desktop\MetaTrader 4.lnk
    2015-02-27 12:36 - 2015-02-27 12:36 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\MetaQuotes
    2015-02-27 12:36 - 2015-02-27 12:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MetaTrader 4
    2015-02-27 12:36 - 2015-02-27 12:36 - 00000000 ____D () C:\Program Files (x86)\MetaTrader 4
    2015-02-27 12:35 - 2015-02-27 12:35 - 00505536 _____ (MetaQuotes Software Corp.) C:\Users\Damien\Downloads\mt4setup(1).exe
    2015-02-26 08:59 - 2015-02-26 08:59 - 00055104 _____ (Microsoft Corporation) C:\windows\system32\Drivers\lpqsidom.sys
    2015-02-25 18:20 - 2015-02-25 19:01 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Skype
    2015-02-25 18:20 - 2015-02-25 18:20 - 00002713 _____ () C:\Users\Public\Desktop\Skype.lnk
    2015-02-25 18:20 - 2015-02-25 18:20 - 00000000 ___RD () C:\Program Files (x86)\Skype
    2015-02-25 18:20 - 2015-02-25 18:20 - 00000000 ____D () C:\Users\Damien\AppData\Local\Skype
    2015-02-25 18:20 - 2015-02-25 18:20 - 00000000 ____D () C:\ProgramData\Skype
    2015-02-25 18:20 - 2015-02-25 18:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
    2015-02-25 18:19 - 2015-02-25 18:19 - 01548384 _____ (Skype Technologies S.A.) C:\Users\Damien\Downloads\SkypeSetup.exe
    2015-02-25 10:27 - 2015-02-25 10:27 - 00053366 _____ () C:\Users\Damien\Downloads\OpaqueTaskbar.zip
    2015-02-25 10:27 - 2015-02-25 10:27 - 00000000 ____D () C:\Users\Damien\Downloads\OpaqueTaskbar
    2015-02-24 22:12 - 2015-02-24 22:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
     
  16. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    2015-02-24 13:37 - 2015-02-24 13:37 - 00000000 ____D () C:\Program Files (x86)\Cities of Earth
    2015-02-24 13:37 - 2007-09-23 23:08 - 02789376 _____ (Screenomania.com) C:\windows\SysWOW64\Cities.scr
    2015-02-24 13:36 - 2015-02-24 13:36 - 01745757 _____ (Screenomania.com ) C:\Users\Damien\Downloads\cities3d_setup.exe
    2015-02-24 13:35 - 2015-02-27 18:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\3Planesoft
    2015-02-24 13:34 - 2015-02-24 13:35 - 06859856 _____ (3Planesoft ) C:\Users\Damien\Downloads\the_one_ring.exe
    2015-02-24 10:16 - 2015-02-24 10:16 - 02742544 _____ (Lenovo Group Limited ) C:\Users\Damien\Downloads\n15fu03w.exe
    2015-02-24 09:06 - 2015-02-24 09:06 - 00002232 _____ () C:\Users\Public\Desktop\DWG TrueView 2015 - English.lnk
    2015-02-24 09:06 - 2015-02-24 09:06 - 00000000 ____D () C:\Users\Public\Documents\Autodesk
    2015-02-24 09:06 - 2015-02-24 09:06 - 00000000 ____D () C:\Users\Damien\AppData\Local\Autodesk
    2015-02-24 09:06 - 2015-02-24 09:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DWG TrueView 2015 - English
    2015-02-24 09:06 - 2015-02-24 09:06 - 00000000 ____D () C:\Program Files\Common Files\Autodesk Shared
    2015-02-24 09:06 - 2015-02-24 09:06 - 00000000 ____D () C:\Program Files\Autodesk
    2015-02-24 09:05 - 2015-02-24 09:06 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Autodesk
    2015-02-24 09:05 - 2015-02-24 09:06 - 00000000 ____D () C:\ProgramData\Autodesk
    2015-02-24 09:05 - 2015-02-24 09:05 - 00000674 _____ () C:\windows\DirectX.log
    2015-02-24 09:05 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\windows\SysWOW64\XAudio2_7.dll
    2015-02-24 09:05 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\windows\system32\XAudio2_7.dll
    2015-02-24 09:05 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\windows\SysWOW64\xactengine3_7.dll
    2015-02-24 09:05 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\windows\system32\xactengine3_7.dll
    2015-02-24 09:05 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\windows\system32\XAPOFX1_5.dll
    2015-02-24 09:05 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\windows\SysWOW64\XAPOFX1_5.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\windows\system32\D3DCompiler_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\windows\system32\D3DX9_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DCompiler_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DX9_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\windows\system32\d3dcsx_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dcsx_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\windows\system32\d3dx10_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx10_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\windows\system32\d3dx11_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx11_43.dll
    2015-02-24 09:05 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\windows\system32\d3dx9_30.dll
    2015-02-24 09:05 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx9_30.dll
    2015-02-24 09:05 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\windows\system32\xactengine2_1.dll
    2015-02-24 09:05 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\windows\SysWOW64\xactengine2_1.dll
    2015-02-24 09:05 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\windows\system32\xinput1_1.dll
    2015-02-24 09:05 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\windows\SysWOW64\xinput1_1.dll
    2015-02-24 09:05 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\windows\system32\x3daudio1_0.dll
    2015-02-24 09:05 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\windows\SysWOW64\x3daudio1_0.dll
    2015-02-24 09:04 - 2015-02-24 09:04 - 00000000 ____D () C:\Autodesk
    2015-02-24 09:00 - 2015-02-24 09:04 - 342413200 _____ () C:\Users\Damien\Downloads\SetupDWGTrueView2015_ENU_64bit.sfx.exe
    2015-02-23 23:27 - 2015-02-23 23:31 - 00000000 ____D () C:\Users\Damien\Downloads\The Grand Budapest Hotel (2014)
    2015-02-23 11:48 - 2015-02-23 11:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
    2015-02-23 11:48 - 2015-02-23 11:48 - 00000000 ____D () C:\Program Files\Common Files\EPSON
    2015-02-23 11:47 - 2015-02-24 13:33 - 00000000 ____D () C:\ProgramData\EPSON
    2015-02-23 11:46 - 2015-01-07 00:05 - 00120320 _____ (SEIKO EPSON CORPORATION) C:\windows\system32\E_YLMIXE.DLL
    2015-02-23 11:46 - 2015-01-07 00:05 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\windows\system32\E_YD4BIXE.DLL
    2015-02-23 11:46 - 2015-01-07 00:05 - 00010752 _____ (SEIKO EPSON CORP.) C:\windows\system32\E_GCINST.DLL
    2015-02-21 10:34 - 2015-02-21 10:34 - 00002782 _____ () C:\Users\Damien\Downloads\07391770.csv
    2015-02-18 11:18 - 2015-02-18 11:18 - 00000000 ____H () C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
    2015-02-18 10:07 - 2015-02-18 10:07 - 00000090 _____ () C:\Users\Damien\Downloads\rootkey.csv
    2015-02-18 09:44 - 2015-02-18 09:44 - 00002330 _____ () C:\Users\Public\Desktop\CloudBerry Online Backup.lnk
    2015-02-18 09:44 - 2015-02-18 09:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CloudBerryLab
    2015-02-18 09:44 - 2015-02-18 09:44 - 00000000 ____D () C:\Program Files (x86)\CloudBerryLab
    2015-02-18 09:25 - 2015-02-18 09:26 - 24215496 _____ () C:\Users\Damien\Downloads\CloudBerryOnlineBackupSetup_v4.0.1.73S3netv4.0.exe
    2015-02-17 17:30 - 2015-02-17 17:30 - 14459960 _____ () C:\Users\Damien\Downloads\TerraAltoLimitedS3OnlineBackupwithTerraAlto_v3.9.2.52_netv4.0_Desktop_Setup_20140702221708.exe
    2015-02-17 16:39 - 2015-02-17 16:39 - 00000462 _____ () C:\Users\Damien\Downloads\Elements (Z).lnk
    2015-02-17 13:08 - 2015-02-17 13:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
    2015-02-17 12:54 - 2014-07-24 15:28 - 00419648 ____C (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
    2015-02-17 12:54 - 2014-07-24 15:28 - 00412992 ____C (Microsoft Corporation) C:\windows\system32\Drivers\spaceport.sys
    2015-02-17 12:54 - 2014-07-24 15:28 - 00280384 ____C (Microsoft Corporation) C:\windows\system32\Drivers\pci.sys
    2015-02-17 12:54 - 2014-07-24 15:28 - 00143680 ____C (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
    2015-02-17 12:54 - 2014-07-24 15:25 - 00054752 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
    2015-02-17 12:54 - 2014-07-24 15:23 - 00125472 _____ (Microsoft Corporation) C:\windows\system32\dwmapi.dll
    2015-02-17 12:54 - 2014-07-24 15:20 - 00645592 _____ (Microsoft Corporation) C:\windows\system32\SHCore.dll
    2015-02-17 12:54 - 2014-07-24 15:20 - 00263400 _____ (Microsoft Corporation) C:\windows\system32\SystemSettingsAdminFlows.exe
    2015-02-17 12:54 - 2014-07-24 15:16 - 02574208 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
    2015-02-17 12:54 - 2014-07-24 15:16 - 00211216 _____ (Microsoft Corporation) C:\windows\system32\SndVol.exe
    2015-02-17 12:54 - 2014-07-24 15:07 - 02009920 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ntfs.sys
    2015-02-17 12:54 - 2014-07-24 15:05 - 01660048 _____ (Microsoft Corporation) C:\windows\system32\winload.efi
    2015-02-17 12:54 - 2014-07-24 15:05 - 01519560 _____ (Microsoft Corporation) C:\windows\system32\winload.exe
    2015-02-17 12:54 - 2014-07-24 15:05 - 01488008 _____ (Microsoft Corporation) C:\windows\system32\winresume.efi
    2015-02-17 12:54 - 2014-07-24 15:05 - 01356840 _____ (Microsoft Corporation) C:\windows\system32\winresume.exe
    2015-02-17 12:54 - 2014-07-24 15:03 - 02141920 _____ (Microsoft Corporation) C:\windows\system32\mfcore.dll
    2015-02-17 12:54 - 2014-07-24 15:03 - 00882136 _____ (Microsoft Corporation) C:\windows\system32\mfplat.dll
    2015-02-17 12:54 - 2014-07-24 15:03 - 00360480 _____ (Microsoft Corporation) C:\windows\system32\mfreadwrite.dll
    2015-02-17 12:54 - 2014-07-24 15:03 - 00233888 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
    2015-02-17 12:54 - 2014-07-24 15:03 - 00205512 _____ (Microsoft Corporation) C:\windows\system32\mftranscode.dll
    2015-02-17 12:54 - 2014-07-24 13:50 - 00098048 _____ (Microsoft Corporation) C:\windows\SysWOW64\dwmapi.dll
    2015-02-17 12:54 - 2014-07-24 13:48 - 02410976 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
    2015-02-17 12:54 - 2014-07-24 13:48 - 00180208 _____ (Microsoft Corporation) C:\windows\SysWOW64\SndVol.exe
    2015-02-17 12:54 - 2014-07-24 13:46 - 00477200 _____ (Microsoft Corporation) C:\windows\SysWOW64\SHCore.dll
    2015-02-17 12:54 - 2014-07-24 13:36 - 02145472 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfcore.dll
    2015-02-17 12:54 - 2014-07-24 13:36 - 00707536 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfplat.dll
    2015-02-17 12:54 - 2014-07-24 13:36 - 00355800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfreadwrite.dll
    2015-02-17 12:54 - 2014-07-24 13:36 - 00180720 _____ (Microsoft Corporation) C:\windows\SysWOW64\mftranscode.dll
    2015-02-17 12:54 - 2014-07-24 11:51 - 00008192 _____ (Microsoft Corporation) C:\windows\system32\KBDRUM.DLL
    2015-02-17 12:54 - 2014-07-24 11:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDYAK.DLL
    2015-02-17 12:54 - 2014-07-24 11:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDTT102.DLL
    2015-02-17 12:54 - 2014-07-24 11:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDTAT.DLL
    2015-02-17 12:54 - 2014-07-24 11:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDRU1.DLL
    2015-02-17 12:54 - 2014-07-24 11:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDBASH.DLL
    2015-02-17 12:54 - 2014-07-24 11:51 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\KBDRU.DLL
    2015-02-17 12:54 - 2014-07-24 11:46 - 00079872 _____ (Microsoft Corporation) C:\windows\system32\Drivers\IPMIDrv.sys
    2015-02-17 12:54 - 2014-07-24 11:45 - 00076800 ____C (Microsoft Corporation) C:\windows\system32\Drivers\hdaudbus.sys
    2015-02-17 12:54 - 2014-07-24 11:44 - 00674816 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv2.sys
    2015-02-17 12:54 - 2014-07-24 11:43 - 00412160 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv.sys
    2015-02-17 12:54 - 2014-07-24 11:42 - 00446976 _____ (Microsoft Corporation) C:\windows\system32\Drivers\nwifi.sys
    2015-02-17 12:54 - 2014-07-24 11:42 - 00126464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\NdisImPlatform.sys
    2015-02-17 12:54 - 2014-07-24 11:41 - 00118272 ____C (Microsoft Corporation) C:\windows\system32\Drivers\bthpan.sys
    2015-02-17 12:54 - 2014-07-24 11:33 - 00059392 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
    2015-02-17 12:54 - 2014-07-24 11:33 - 00050688 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
    2015-02-17 12:54 - 2014-07-24 11:06 - 00220160 _____ (Microsoft Corporation) C:\windows\system32\iasnap.dll
    2015-02-17 12:54 - 2014-07-24 11:05 - 00287232 _____ (Microsoft Corporation) C:\windows\system32\usbmon.dll
    2015-02-17 12:54 - 2014-07-24 11:05 - 00226816 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll
    2015-02-17 12:54 - 2014-07-24 10:52 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDYAK.DLL
    2015-02-17 12:54 - 2014-07-24 10:52 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDTT102.DLL
    2015-02-17 12:54 - 2014-07-24 10:52 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDTAT.DLL
    2015-02-17 12:54 - 2014-07-24 10:51 - 00008192 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRUM.DLL
    2015-02-17 12:54 - 2014-07-24 10:51 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRU1.DLL
    2015-02-17 12:54 - 2014-07-24 10:51 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDBASH.DLL
    2015-02-17 12:54 - 2014-07-24 10:51 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRU.DLL
    2015-02-17 12:54 - 2014-07-24 10:49 - 00065536 _____ (Microsoft Corporation) C:\windows\system32\WorkFoldersGPExt.dll
    2015-02-17 12:54 - 2014-07-24 10:33 - 00026112 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
    2015-02-17 12:54 - 2014-07-24 10:32 - 00207360 _____ (Microsoft Corporation) C:\windows\system32\powercfg.cpl
    2015-02-17 12:54 - 2014-07-24 10:20 - 02050560 _____ (Microsoft Corporation) C:\windows\system32\SRH.dll
    2015-02-17 12:54 - 2014-07-24 10:18 - 01089024 _____ (Microsoft Corporation) C:\windows\system32\gpedit.dll
    2015-02-17 12:54 - 2014-07-24 10:12 - 00878592 _____ (Microsoft Corporation) C:\windows\system32\ActionCenter.dll
    2015-02-17 12:54 - 2014-07-24 10:10 - 01844224 _____ (Microsoft Corporation) C:\windows\system32\Display.dll
    2015-02-17 12:54 - 2014-07-24 10:10 - 00834560 _____ (Microsoft Corporation) C:\windows\system32\osk.exe
    2015-02-17 12:54 - 2014-07-24 10:10 - 00198656 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll
    2015-02-17 12:54 - 2014-07-24 10:10 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\iasnap.dll
    2015-02-17 12:54 - 2014-07-24 10:05 - 00187392 _____ (Microsoft Corporation) C:\windows\system32\WorkFoldersShell.dll
    2015-02-17 12:54 - 2014-07-24 09:52 - 00621056 _____ (Microsoft Corporation) C:\windows\system32\comdlg32.dll
    2015-02-17 12:54 - 2014-07-24 09:44 - 16874496 _____ (Microsoft Corporation) C:\windows\system32\Windows.UI.Xaml.dll
    2015-02-17 12:54 - 2014-07-24 09:42 - 00206336 _____ (Microsoft Corporation) C:\windows\SysWOW64\powercfg.cpl
    2015-02-17 12:54 - 2014-07-24 09:40 - 00557056 _____ (Microsoft Corporation) C:\windows\system32\PrintDialogs.dll
    2015-02-17 12:54 - 2014-07-24 09:39 - 00770048 _____ (Microsoft Corporation) C:\windows\system32\WorkfoldersControl.dll
    2015-02-17 12:54 - 2014-07-24 09:33 - 01741824 _____ (Microsoft Corporation) C:\windows\SysWOW64\SRH.dll
    2015-02-17 12:54 - 2014-07-24 09:32 - 01048064 _____ (Microsoft Corporation) C:\windows\SysWOW64\gpedit.dll
    2015-02-17 12:54 - 2014-07-24 09:27 - 00779264 _____ (Microsoft Corporation) C:\windows\SysWOW64\osk.exe
    2015-02-17 12:54 - 2014-07-24 09:25 - 00832512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ActionCenter.dll
    2015-02-17 12:54 - 2014-07-24 09:24 - 01817088 _____ (Microsoft Corporation) C:\windows\SysWOW64\Display.dll
    2015-02-17 12:54 - 2014-07-24 09:21 - 00134144 _____ (Microsoft Corporation) C:\windows\system32\browser.dll
    2015-02-17 12:54 - 2014-07-24 09:18 - 00018432 _____ (Microsoft Corporation) C:\windows\system32\wlansvcpal.dll
    2015-02-17 12:54 - 2014-07-24 09:16 - 12730880 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.UI.Xaml.dll
    2015-02-17 12:54 - 2014-07-24 09:14 - 00443904 _____ (Microsoft Corporation) C:\windows\system32\wlansec.dll
    2015-02-17 12:54 - 2014-07-24 09:12 - 00127488 _____ (Microsoft Corporation) C:\windows\system32\WiFiDisplay.dll
    2015-02-17 12:54 - 2014-07-24 09:11 - 00356864 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
    2015-02-17 12:54 - 2014-07-24 09:11 - 00063488 _____ (Microsoft Corporation) C:\windows\system32\wshbth.dll
    2015-02-17 12:54 - 2014-07-24 09:10 - 00540672 _____ (Microsoft Corporation) C:\windows\SysWOW64\comdlg32.dll
    2015-02-17 12:54 - 2014-07-24 09:04 - 00492032 _____ (Microsoft Corporation) C:\windows\SysWOW64\PrintDialogs.dll
    2015-02-17 12:54 - 2014-07-24 09:04 - 00183808 _____ (Microsoft Corp.) C:\windows\system32\Defrag.exe
    2015-02-17 12:54 - 2014-07-24 09:03 - 00324096 _____ (Microsoft Corporation) C:\windows\system32\srvsvc.dll
    2015-02-17 12:54 - 2014-07-24 08:58 - 00105472 _____ (Microsoft Corporation) C:\windows\system32\BluetoothApis.dll
    2015-02-17 12:54 - 2014-07-24 08:53 - 01261056 _____ (Microsoft Corporation) C:\windows\system32\gpsvc.dll
    2015-02-17 12:54 - 2014-07-24 08:53 - 00449536 _____ (Microsoft Corporation) C:\windows\system32\defragsvc.dll
    2015-02-17 12:54 - 2014-07-24 08:49 - 01287680 _____ (Microsoft Corporation) C:\windows\system32\mispace.dll
    2015-02-17 12:54 - 2014-07-24 08:49 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\wlanapi.dll
    2015-02-17 12:54 - 2014-07-24 08:48 - 00659968 _____ (Microsoft Corporation) C:\windows\system32\Windows.Devices.Bluetooth.dll
    2015-02-17 12:54 - 2014-07-24 08:47 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\wcmcsp.dll
    2015-02-17 12:54 - 2014-07-24 08:43 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wshbth.dll
    2015-02-17 12:54 - 2014-07-24 08:39 - 02397184 _____ (Microsoft Corporation) C:\windows\system32\storagewmi.dll
    2015-02-17 12:54 - 2014-07-24 08:38 - 00371200 _____ (Microsoft Corporation) C:\windows\system32\wlanmsm.dll
    2015-02-17 12:54 - 2014-07-24 08:36 - 00079872 _____ (Microsoft Corporation) C:\windows\SysWOW64\BluetoothApis.dll
    2015-02-17 12:54 - 2014-07-24 08:32 - 01532416 _____ (Microsoft Corporation) C:\windows\system32\wlansvc.dll
    2015-02-17 12:54 - 2014-07-24 08:30 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\wlanapi.dll
    2015-02-17 12:54 - 2014-07-24 08:29 - 00439296 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.Devices.Bluetooth.dll
    2015-02-17 12:54 - 2014-07-24 08:28 - 00595456 _____ (Microsoft Corporation) C:\windows\system32\Windows.Networking.dll
    2015-02-17 12:54 - 2014-07-24 08:23 - 01404416 _____ (Microsoft Corporation) C:\windows\SysWOW64\storagewmi.dll
    2015-02-17 12:54 - 2014-07-24 08:22 - 00487936 _____ (Microsoft Corporation) C:\windows\system32\winspool.drv
    2015-02-17 12:54 - 2014-07-24 08:21 - 01231872 _____ (Microsoft Corporation) C:\windows\system32\Windows.Media.dll
    2015-02-17 12:54 - 2014-07-24 08:21 - 00302080 _____ (Microsoft Corporation) C:\windows\SysWOW64\wlanmsm.dll
    2015-02-17 12:54 - 2014-07-24 08:19 - 00388608 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
    2015-02-17 12:54 - 2014-07-24 08:18 - 01144320 _____ (Microsoft Corporation) C:\windows\system32\wwanmm.dll
    2015-02-17 12:54 - 2014-07-24 08:18 - 00795136 _____ (Microsoft Corporation) C:\windows\system32\spoolsv.exe
    2015-02-17 12:54 - 2014-07-24 08:18 - 00093696 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
    2015-02-17 12:54 - 2014-07-24 08:16 - 00505344 _____ (Microsoft Corporation) C:\windows\system32\VAN.dll
    2015-02-17 12:54 - 2014-07-24 08:16 - 00084480 _____ (Microsoft Corporation) C:\windows\system32\wpdbusenum.dll
    2015-02-17 12:54 - 2014-07-24 08:15 - 00828416 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
    2015-02-17 12:54 - 2014-07-24 08:15 - 00721408 _____ (Microsoft Corporation) C:\windows\system32\twinapi.dll
    2015-02-17 12:54 - 2014-07-24 08:15 - 00432128 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.Networking.dll
    2015-02-17 12:54 - 2014-07-24 08:13 - 00226304 _____ (Microsoft Corporation) C:\windows\system32\SndVolSSO.dll
    2015-02-17 12:54 - 2014-07-24 08:10 - 00889344 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.Media.dll
    2015-02-17 12:54 - 2014-07-24 08:10 - 00371712 _____ (Microsoft Corporation) C:\windows\SysWOW64\winspool.drv
    2015-02-17 12:54 - 2014-07-24 08:08 - 00321536 _____ (Microsoft Corporation) C:\windows\system32\stobject.dll
    2015-02-17 12:54 - 2014-07-24 08:07 - 01705472 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
    2015-02-17 12:54 - 2014-07-24 08:06 - 00080896 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
    2015-02-17 12:54 - 2014-07-24 08:05 - 00448000 _____ (Microsoft Corporation) C:\windows\SysWOW64\VAN.dll
    2015-02-17 12:54 - 2014-07-24 08:04 - 00667136 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
    2015-02-17 12:54 - 2014-07-24 08:02 - 03465216 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
    2015-02-17 12:54 - 2014-07-24 08:01 - 01992192 _____ (Microsoft Corporation) C:\windows\system32\XpsPrint.dll
    2015-02-17 12:54 - 2014-07-24 08:00 - 02100736 _____ (Microsoft Corporation) C:\windows\system32\SystemSettingsAdminFlowUI.dll
    2015-02-17 12:54 - 2014-07-24 07:58 - 00432640 _____ (Microsoft Corporation) C:\windows\system32\wwanconn.dll
    2015-02-17 12:54 - 2014-07-24 07:58 - 00288768 _____ (Microsoft Corporation) C:\windows\SysWOW64\stobject.dll
    2015-02-17 12:54 - 2014-07-24 07:54 - 01290752 _____ (Microsoft Corporation) C:\windows\SysWOW64\XpsPrint.dll
    2015-02-17 12:54 - 2014-07-24 07:50 - 01182208 _____ (Microsoft Corporation) C:\windows\system32\printui.dll
    2015-02-17 12:54 - 2014-07-24 07:47 - 00576512 _____ (Microsoft Corporation) C:\windows\system32\SettingSync.dll
    2015-02-17 12:54 - 2014-07-24 07:44 - 01057792 _____ (Microsoft Corporation) C:\windows\SysWOW64\printui.dll
    2015-02-17 12:54 - 2014-07-24 07:41 - 00459264 _____ (Microsoft Corporation) C:\windows\SysWOW64\SettingSync.dll
    2015-02-17 12:54 - 2014-07-24 07:28 - 01600000 _____ (Microsoft Corporation) C:\windows\system32\workfolderssvc.dll
    2015-02-17 12:54 - 2014-07-24 04:11 - 00513544 _____ () C:\windows\SysWOW64\locale.nls
    2015-02-17 12:54 - 2014-07-24 04:11 - 00513544 _____ () C:\windows\system32\locale.nls
    2015-02-17 12:54 - 2014-07-12 05:55 - 00268288 _____ (Microsoft Corporation) C:\windows\system32\wisp.dll
    2015-02-17 12:54 - 2014-07-12 04:58 - 00210944 _____ (Microsoft Corporation) C:\windows\SysWOW64\wisp.dll
    2015-02-17 12:54 - 2014-07-04 12:59 - 00295424 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ks.sys
    2015-02-17 12:54 - 2014-07-04 10:29 - 00117248 _____ (Microsoft Corporation) C:\windows\system32\AppxSip.dll
    2015-02-17 12:54 - 2014-07-04 10:20 - 01656832 _____ (Microsoft Corporation) C:\windows\system32\GdiPlus.dll
    2015-02-17 12:54 - 2014-07-04 10:06 - 00095232 _____ (Microsoft Corporation) C:\windows\SysWOW64\AppxSip.dll
    2015-02-17 12:54 - 2014-07-04 10:00 - 01351168 _____ (Microsoft Corporation) C:\windows\SysWOW64\GdiPlus.dll
    2015-02-17 12:54 - 2014-07-04 09:30 - 00544768 _____ (Microsoft Corporation) C:\windows\system32\AppxPackaging.dll
    2015-02-17 12:54 - 2014-07-04 09:27 - 00474112 _____ (Microsoft Corporation) C:\windows\SysWOW64\AppxPackaging.dll
    2015-02-17 12:54 - 2014-06-27 06:22 - 00246272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srvnet.sys
    2015-02-17 12:54 - 2014-06-26 00:32 - 01029632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mispace.dll
    2015-02-17 12:54 - 2014-06-26 00:29 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\dab.dll
    2015-02-17 12:54 - 2014-06-19 23:37 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
    2015-02-17 12:54 - 2014-06-19 02:13 - 00310080 ____C (Microsoft Corporation) C:\windows\system32\Drivers\volsnap.sys
    2015-02-17 12:54 - 2014-06-14 06:03 - 02389504 _____ (Microsoft Corporation) C:\windows\system32\d3d10warp.dll
    2015-02-17 12:54 - 2014-06-14 05:46 - 02071552 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d10warp.dll
    2015-02-17 12:54 - 2014-06-07 12:46 - 00216368 _____ (Microsoft Corporation) C:\windows\system32\rsaenh.dll
    2015-02-17 12:54 - 2014-06-07 10:20 - 00189016 _____ (Microsoft Corporation) C:\windows\SysWOW64\rsaenh.dll
    2015-02-17 12:54 - 2014-06-05 14:00 - 01118040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ndis.sys
    2015-02-17 12:54 - 2014-06-05 10:18 - 01018368 _____ (Microsoft Corporation) C:\windows\system32\aclui.dll
    2015-02-17 12:54 - 2014-06-05 09:42 - 00889856 _____ (Microsoft Corporation) C:\windows\SysWOW64\aclui.dll
    2015-02-17 12:54 - 2014-05-31 05:00 - 01463808 _____ (Microsoft Corporation) C:\windows\system32\wsecedit.dll
    2015-02-17 12:54 - 2014-05-31 04:18 - 01319936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wsecedit.dll
    2015-02-17 12:54 - 2014-05-29 06:23 - 00427008 _____ (Microsoft Corporation) C:\windows\system32\clusapi.dll
    2015-02-17 12:54 - 2014-05-29 05:25 - 00313856 _____ (Microsoft Corporation) C:\windows\SysWOW64\clusapi.dll
    2015-02-17 12:54 - 2014-05-26 07:26 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\AppxSysprep.dll
    2015-02-17 12:54 - 2014-05-10 10:12 - 00387896 _____ (Microsoft Corporation) C:\windows\system32\bcryptprimitives.dll
    2015-02-17 12:54 - 2014-05-10 08:46 - 00335680 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcryptprimitives.dll
    2015-02-17 12:54 - 2014-05-06 04:41 - 00486744 _____ (Microsoft Corporation) C:\windows\system32\netcfgx.dll
    2015-02-17 12:54 - 2014-05-06 00:55 - 00391000 _____ (Microsoft Corporation) C:\windows\SysWOW64\netcfgx.dll
    2015-02-17 12:54 - 2014-03-25 02:27 - 00160600 _____ (Microsoft Corporation) C:\windows\system32\winmmbase.dll
    2015-02-17 12:54 - 2014-03-25 02:27 - 00123920 _____ (Microsoft Corporation) C:\windows\system32\winmm.dll
    2015-02-17 12:54 - 2014-03-25 01:20 - 00128568 _____ (Microsoft Corporation) C:\windows\SysWOW64\winmm.dll
    2015-02-17 12:54 - 2014-03-25 01:20 - 00127544 _____ (Microsoft Corporation) C:\windows\SysWOW64\winmmbase.dll
    2015-02-17 12:52 - 2015-02-17 13:02 - 00083330 _____ () C:\Users\Damien\Desktop\AA Job Booking Form R1.xlsm
    2015-02-17 12:46 - 2015-01-23 04:41 - 06041600 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
    2015-02-17 12:46 - 2015-01-23 03:17 - 04300800 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
    2015-02-17 12:25 - 2015-02-03 19:31 - 00714720 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
    2015-02-17 12:25 - 2015-02-03 19:31 - 00106976 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
    2015-02-17 12:21 - 2015-02-17 12:21 - 00000000 ___SD () C:\windows\system32\CompatTel
    2015-02-17 12:21 - 2015-02-17 12:21 - 00000000 ____D () C:\windows\system32\appraiser
    2015-02-17 02:41 - 2015-02-17 02:44 - 00000000 ____D () C:\windows\system32\MRT
    2015-02-17 02:41 - 2015-01-29 17:49 - 116773704 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
    2015-02-17 02:40 - 2014-04-14 03:29 - 01018880 _____ (Microsoft Corporation) C:\windows\system32\termsrv.dll
    2015-02-17 00:22 - 2015-02-19 19:22 - 00000000 ___RD () C:\Users\Damien\Dropbox
    2015-02-17 00:22 - 2015-02-17 00:22 - 00001151 _____ () C:\Users\Damien\Desktop\Dropbox.lnk
    2015-02-17 00:18 - 2015-02-17 00:18 - 00000000 ____D () C:\Users\Damien_2\AppData\Roaming\Mozilla
    2015-02-17 00:18 - 2015-02-17 00:18 - 00000000 ____D () C:\Users\Damien_2\AppData\Local\Mozilla
    2015-02-17 00:17 - 2015-02-17 00:17 - 00003596 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1301979038-2669888510-292050220-1003
    2015-02-17 00:13 - 2015-02-17 00:13 - 00000000 ____D () C:\Users\Damien_2\AppData\Roaming\Intel Corporation
    2015-02-17 00:12 - 2015-02-17 00:20 - 00002260 _____ () C:\Users\Damien_2\AppData\Local\BTServer.log
    2015-02-17 00:12 - 2015-02-17 00:13 - 00000000 ____D () C:\Users\Damien_2\AppData\Local\Packages
    2015-02-17 00:12 - 2015-02-17 00:12 - 00001453 _____ () C:\Users\Damien_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
    2015-02-17 00:12 - 2015-02-17 00:12 - 00001260 _____ () C:\Users\Damien_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BTServer Toasts App.lnk
    2015-02-17 00:12 - 2015-02-17 00:12 - 00000020 ___SH () C:\Users\Damien_2\ntuser.ini
    2015-02-17 00:12 - 2015-02-17 00:12 - 00000000 ____D () C:\Users\Damien_2\Documents\My Bluetooth
    2015-02-17 00:12 - 2015-02-17 00:12 - 00000000 ____D () C:\Users\Damien_2\AppData\Roaming\My Bluetooth
    2015-02-17 00:12 - 2015-02-17 00:12 - 00000000 ____D () C:\Users\Damien_2\AppData\Roaming\Hightail for Lenovo
    2015-02-17 00:12 - 2015-02-17 00:12 - 00000000 ____D () C:\Users\Damien_2\AppData\Roaming\Adobe
    2015-02-17 00:12 - 2015-02-17 00:12 - 00000000 ____D () C:\Users\Damien_2\AppData\Local\VirtualStore
    2015-02-17 00:11 - 2015-02-17 00:13 - 00000000 ____D () C:\Users\Damien_2\AppData\Local\Pokki
    2015-02-17 00:11 - 2015-02-17 00:12 - 00000000 ____D () C:\Users\Damien_2
    2015-02-17 00:11 - 2014-08-17 16:06 - 00000126 _____ () C:\Users\Damien_2\Desktop\Adobe Photo Offer.url
    2015-02-17 00:11 - 2014-08-17 15:18 - 00000000 ___RD () C:\Users\Damien_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
    2015-02-17 00:11 - 2014-03-26 10:21 - 00000190 _____ () C:\Users\Damien_2\Desktop\FREE CALLS with Voxox.url
    2015-02-17 00:11 - 2014-03-18 10:05 - 00000000 ___RD () C:\Users\Damien_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
    2015-02-17 00:11 - 2014-03-18 09:55 - 00000369 _____ () C:\Users\Damien_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
    2015-02-17 00:11 - 2014-03-18 09:55 - 00000369 _____ () C:\Users\Damien_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
    2015-02-17 00:11 - 2013-08-22 15:36 - 00000000 ___RD () C:\Users\Damien_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
    2015-02-17 00:11 - 2013-08-22 15:36 - 00000000 ____D () C:\Users\Damien_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
    2015-02-16 18:24 - 2015-02-16 18:24 - 00002093 _____ () C:\Users\Damien\Desktop\Insul 8.0.lnk
    2015-02-16 17:22 - 2014-11-10 02:29 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\DeviceSetupStatusProvider.dll
    2015-02-16 17:22 - 2014-11-10 01:51 - 00028672 _____ (Microsoft Corporation) C:\windows\SysWOW64\DeviceSetupStatusProvider.dll
    2015-02-16 17:22 - 2014-08-15 00:36 - 00146752 _____ (Microsoft Corporation) C:\windows\system32\Drivers\msgpioclx.sys
    2015-02-16 17:22 - 2014-07-30 01:56 - 00299520 _____ (Microsoft Corporation) C:\windows\system32\WSDMon.dll
    2015-02-16 17:22 - 2014-07-29 05:22 - 00205824 _____ (Microsoft Corporation) C:\windows\system32\tcpmon.dll
    2015-02-16 17:22 - 2014-05-30 03:03 - 00563200 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys
    2015-02-16 17:21 - 2014-10-30 23:39 - 01970432 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
    2015-02-16 17:21 - 2014-10-30 23:38 - 01612992 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
    2015-02-16 17:15 - 2015-01-15 22:43 - 00563504 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
    2015-02-16 17:15 - 2015-01-15 22:43 - 00177984 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
    2015-02-16 17:15 - 2015-01-14 04:22 - 00445440 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
    2015-02-16 17:15 - 2015-01-14 03:53 - 00324096 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
    2015-02-16 17:15 - 2014-12-19 08:57 - 00788680 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
    2015-02-16 17:15 - 2014-12-19 08:25 - 00602776 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
    2015-02-16 17:15 - 2014-12-09 01:50 - 00225280 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
    2015-02-16 17:15 - 2014-10-29 02:51 - 00154112 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
    2015-02-16 17:15 - 2014-10-29 02:50 - 00736768 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
    2015-02-16 17:15 - 2014-10-29 02:06 - 00736768 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
    2015-02-16 17:15 - 2014-10-29 02:06 - 00154112 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
    2015-02-16 17:15 - 2014-10-29 01:31 - 01441792 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
    2015-02-16 17:15 - 2014-10-13 02:33 - 00116032 _____ (Microsoft Corporation) C:\windows\system32\consent.exe
    2015-02-16 17:15 - 2014-10-11 00:58 - 03320320 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
    2015-02-16 17:15 - 2014-10-11 00:53 - 03607040 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
    2015-02-16 17:15 - 2014-10-08 07:30 - 00110080 _____ (Microsoft Corporation) C:\windows\system32\appinfo.dll
    2015-02-16 17:15 - 2014-10-08 07:09 - 00428032 _____ (Microsoft Corporation) C:\windows\system32\msihnd.dll
    2015-02-16 17:15 - 2014-10-08 06:27 - 00325120 _____ (Microsoft Corporation) C:\windows\SysWOW64\msihnd.dll
    2015-02-16 17:15 - 2014-10-08 05:32 - 02773504 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
    2015-02-16 17:15 - 2014-10-08 05:19 - 02459136 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
    2015-02-16 17:15 - 2014-09-22 04:38 - 01519488 _____ (Microsoft Corporation) C:\windows\system32\user32.dll
    2015-02-16 17:15 - 2014-09-22 03:06 - 00258368 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WdFilter.sys
    2015-02-16 17:15 - 2014-09-22 03:06 - 00114496 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WdNisDrv.sys
    2015-02-16 17:15 - 2014-09-22 02:49 - 00035320 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WdBoot.sys
    2015-02-16 17:15 - 2014-09-19 00:16 - 01346048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user32.dll
    2015-02-16 17:15 - 2014-09-02 22:08 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\winshfhc.dll
    2015-02-16 17:15 - 2014-09-02 22:08 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\winshfhc.dll
    2015-02-16 17:13 - 2015-01-13 22:11 - 01762840 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
    2015-02-16 17:13 - 2015-01-13 22:04 - 01489072 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
    2015-02-16 17:13 - 2014-12-09 03:45 - 00393728 _____ (Microsoft Corporation) C:\windows\SysWOW64\scesrv.dll
    2015-02-16 17:13 - 2014-12-09 01:56 - 00538624 _____ (Microsoft Corporation) C:\windows\system32\scesrv.dll
    2015-02-16 17:13 - 2014-09-27 07:13 - 00104336 _____ (Microsoft Corporation) C:\windows\system32\ncryptsslp.dll
    2015-02-16 17:13 - 2014-09-27 05:24 - 00088800 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncryptsslp.dll
    2015-02-16 17:13 - 2014-09-27 03:30 - 00185856 _____ (Microsoft Corporation) C:\windows\system32\dpapisrv.dll
    2015-02-16 17:13 - 2014-06-20 01:48 - 01273184 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
    2015-02-16 17:13 - 2014-06-19 23:52 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
    2015-02-16 17:08 - 2014-10-10 01:58 - 00027456 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rdpvideominiport.sys
    2015-02-16 17:08 - 2014-10-08 07:34 - 00131584 _____ (Microsoft Corporation) C:\windows\system32\rdpudd.dll
    2015-02-16 17:08 - 2014-10-08 07:24 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\rfxvmt.dll
    2015-02-16 17:08 - 2014-10-08 05:23 - 03547648 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
    2015-02-16 17:07 - 2014-06-13 01:15 - 00517528 _____ (Microsoft Corporation) C:\windows\system32\dxgi.dll
    2015-02-16 17:07 - 2014-06-13 01:14 - 01557848 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
    2015-02-16 17:07 - 2014-06-13 00:10 - 00406400 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxgi.dll
    2015-02-16 17:07 - 2014-06-06 11:34 - 02133504 _____ (Microsoft Corporation) C:\windows\system32\dwmcore.dll
    2015-02-16 17:06 - 2014-12-08 23:12 - 00391526 _____ () C:\windows\system32\ApnDatabase.xml
    2015-02-16 17:06 - 2014-08-07 02:12 - 01336624 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
    2015-02-16 17:06 - 2014-08-02 03:56 - 01064448 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
    2015-02-16 17:04 - 2014-08-23 05:18 - 02149376 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
    2015-02-16 17:04 - 2014-08-23 05:03 - 01346048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll
    2015-02-16 17:04 - 2014-06-09 22:13 - 00035480 _____ (Microsoft Corporation) C:\windows\SysWOW64\TsWpfWrp.exe
    2015-02-16 17:04 - 2014-06-09 22:13 - 00035480 _____ (Microsoft Corporation) C:\windows\system32\TsWpfWrp.exe
    2015-02-16 17:03 - 2014-05-19 06:31 - 00057856 _____ (Microsoft Corporation) C:\windows\system32\drvcfg.exe
    2015-02-16 17:03 - 2014-05-19 06:21 - 00110592 _____ (Microsoft Corporation) C:\windows\system32\drvinst.exe
    2015-02-16 17:03 - 2014-05-19 05:23 - 00098816 _____ (Microsoft Corporation) C:\windows\SysWOW64\drvinst.exe
    2015-02-16 17:03 - 2014-04-30 04:23 - 00353280 _____ (Microsoft Corporation) C:\windows\system32\dhcpcore.dll
    2015-02-16 17:03 - 2014-04-30 03:42 - 00403968 _____ (Microsoft Corporation) C:\windows\system32\vpnike.dll
    2015-02-16 17:03 - 2014-04-28 22:40 - 00721408 _____ (Microsoft Corporation) C:\windows\system32\fveapi.dll
    2015-02-16 17:03 - 2014-04-14 09:37 - 02125344 _____ (Microsoft Corporation) C:\windows\system32\d3d9.dll
    2015-02-16 17:03 - 2014-04-14 08:08 - 01797896 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d9.dll
    2015-02-16 17:02 - 2014-05-13 07:01 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\BulkOperationHost.exe
    2015-02-16 17:02 - 2014-05-03 05:36 - 00997888 _____ (Microsoft Corporation) C:\windows\system32\reseteng.dll
    2015-02-16 17:02 - 2014-05-03 05:19 - 00071168 _____ (Microsoft Corporation) C:\windows\system32\ncobjapi.dll
    2015-02-16 17:02 - 2014-05-03 05:08 - 00301056 _____ (Microsoft Corporation) C:\windows\system32\framedynos.dll
    2015-02-16 17:02 - 2014-05-03 05:07 - 00262656 _____ (Microsoft Corporation) C:\windows\system32\framedyn.dll
    2015-02-16 17:02 - 2014-05-03 04:46 - 00052736 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncobjapi.dll
    2015-02-16 17:02 - 2014-05-03 04:37 - 00235008 _____ (Microsoft Corporation) C:\windows\SysWOW64\framedynos.dll
    2015-02-16 17:02 - 2014-05-03 04:37 - 00207360 _____ (Microsoft Corporation) C:\windows\SysWOW64\framedyn.dll
    2015-02-16 17:02 - 2014-05-02 23:26 - 00050745 _____ () C:\windows\system32\srms.dat
    2015-02-16 17:02 - 2014-04-30 06:43 - 00071680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\vwififlt.sys
    2015-02-16 17:02 - 2014-04-30 06:41 - 00402432 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
    2015-02-16 17:02 - 2014-04-30 06:41 - 00096768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\agilevpn.sys
    2015-02-16 17:02 - 2014-04-30 06:41 - 00038912 _____ (Microsoft Corporation) C:\windows\system32\Drivers\vwifimp.sys
    2015-02-16 17:02 - 2014-04-30 05:45 - 00123392 _____ (Microsoft Corporation) C:\windows\system32\Robocopy.exe
    2015-02-16 17:02 - 2014-04-30 04:48 - 00106496 _____ (Microsoft Corporation) C:\windows\SysWOW64\Robocopy.exe
    2015-02-16 17:02 - 2014-04-30 04:24 - 00065024 _____ (Microsoft Corporation) C:\windows\system32\dhcpcsvc6.dll
    2015-02-16 17:02 - 2014-04-30 04:23 - 00271872 _____ (Microsoft Corporation) C:\windows\system32\dhcpcore6.dll
    2015-02-16 17:02 - 2014-04-30 04:23 - 00087552 _____ (Microsoft Corporation) C:\windows\system32\dhcpcsvc.dll
    2015-02-16 17:02 - 2014-04-30 04:14 - 00827392 _____ (Microsoft Corporation) C:\windows\system32\BFE.DLL
    2015-02-16 17:02 - 2014-04-30 03:59 - 01063424 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL
    2015-02-16 17:02 - 2014-04-30 03:46 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dhcpcore.dll
    2015-02-16 17:02 - 2014-04-30 03:46 - 00229888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dhcpcore6.dll
    2015-02-16 17:02 - 2014-04-30 03:46 - 00056320 _____ (Microsoft Corporation) C:\windows\SysWOW64\dhcpcsvc6.dll
    2015-02-16 17:02 - 2014-04-30 03:45 - 00062976 _____ (Microsoft Corporation) C:\windows\SysWOW64\dhcpcsvc.dll
    2015-02-16 17:02 - 2014-04-26 16:39 - 00339456 _____ (Microsoft Corporation) C:\windows\system32\bdesvc.dll
    2015-02-16 17:02 - 2014-04-14 05:18 - 00011776 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d8thk.dll
    2015-02-16 17:01 - 2014-08-23 07:48 - 02374784 _____ (Microsoft Corporation) C:\windows\explorer.exe
    2015-02-16 17:01 - 2014-08-23 07:13 - 02084520 _____ (Microsoft Corporation) C:\windows\SysWOW64\explorer.exe
    2015-02-16 17:01 - 2014-08-23 06:10 - 00068096 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
    2015-02-16 17:01 - 2014-08-23 05:32 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
    2015-02-16 17:01 - 2014-08-23 04:33 - 00796672 _____ (Microsoft Corporation) C:\windows\system32\uDWM.dll
    2015-02-16 17:00 - 2015-01-12 03:09 - 25056256 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
    2015-02-16 17:00 - 2015-01-12 02:48 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
    2015-02-16 17:00 - 2015-01-12 02:48 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
    2015-02-16 17:00 - 2015-01-12 02:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
    2015-02-16 17:00 - 2015-01-12 02:34 - 00816128 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
    2015-02-16 17:00 - 2015-01-12 02:25 - 19740160 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
    2015-02-16 17:00 - 2015-01-12 02:21 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
    2015-02-16 17:00 - 2015-01-12 02:08 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
    2015-02-16 17:00 - 2015-01-12 02:07 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
    2015-02-16 17:00 - 2015-01-12 02:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
    2015-02-16 17:00 - 2015-01-12 02:02 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
    2015-02-16 17:00 - 2015-01-12 01:58 - 01032704 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
    2015-02-16 17:00 - 2015-01-12 01:55 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
    2015-02-16 17:00 - 2015-01-12 01:51 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
    2015-02-16 17:00 - 2015-01-12 01:48 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
    2015-02-16 17:00 - 2015-01-12 01:48 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
    2015-02-16 17:00 - 2015-01-12 01:48 - 00374272 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
    2015-02-16 17:00 - 2015-01-12 01:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
    2015-02-16 17:00 - 2015-01-12 01:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
    2015-02-16 17:00 - 2015-01-12 01:43 - 14401024 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
    2015-02-16 17:00 - 2015-01-12 01:34 - 00128000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
    2015-02-16 17:00 - 2015-01-12 01:30 - 00880128 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
    2015-02-16 17:00 - 2015-01-12 01:27 - 02865152 _____ (Microsoft Corporation) C:\windows\system32\actxprxy.dll
    2015-02-16 17:00 - 2015-01-12 01:27 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
    2015-02-16 17:00 - 2015-01-12 01:25 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
    2015-02-16 17:00 - 2015-01-12 01:23 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
    2015-02-16 17:00 - 2015-01-12 01:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
    2015-02-16 17:00 - 2015-01-12 01:23 - 00327168 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
    2015-02-16 17:00 - 2015-01-12 01:14 - 12829184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
    2015-02-16 17:00 - 2015-01-12 01:14 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
    2015-02-16 17:00 - 2015-01-12 01:02 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
    2015-02-16 17:00 - 2015-01-12 01:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
    2015-02-16 17:00 - 2015-01-12 00:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
    2015-02-16 17:00 - 2015-01-12 00:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
    2015-02-16 17:00 - 2015-01-10 07:00 - 00430080 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
    2015-02-16 17:00 - 2015-01-10 06:38 - 00359424 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
    2015-02-16 17:00 - 2014-11-22 02:49 - 00417280 _____ (Microsoft Corporation) C:\windows\system32\html.iec
    2015-02-16 17:00 - 2014-11-22 02:06 - 00340992 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
    2015-02-16 17:00 - 2014-11-22 02:06 - 00145408 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
    2015-02-16 17:00 - 2014-11-22 02:05 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
    2015-02-16 17:00 - 2014-11-22 01:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
    2015-02-16 17:00 - 2014-11-22 01:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
    2015-02-16 17:00 - 2014-10-31 05:12 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe
    2015-02-16 17:00 - 2014-10-31 05:12 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe
    2015-02-16 17:00 - 2014-10-31 05:10 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe
    2015-02-16 17:00 - 2014-10-31 05:09 - 00064512 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll
    2015-02-16 17:00 - 2014-10-31 05:08 - 00012800 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe
    2015-02-16 17:00 - 2014-10-31 05:06 - 00237568 _____ (Microsoft Corporation) C:\windows\system32\url.dll
    2015-02-16 17:00 - 2014-10-31 05:06 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
    2015-02-16 17:00 - 2014-10-31 05:06 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
    2015-02-16 17:00 - 2014-10-31 04:57 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
    2015-02-16 17:00 - 2014-10-31 04:56 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
    2015-02-16 17:00 - 2014-10-31 04:54 - 00132096 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll
    2015-02-16 17:00 - 2014-10-31 04:53 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
    2015-02-16 17:00 - 2014-10-31 04:52 - 00108544 _____ (Microsoft Corporation) C:\windows\system32\hlink.dll
    2015-02-16 17:00 - 2014-10-31 04:51 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
    2015-02-16 17:00 - 2014-10-31 04:51 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
    2015-02-16 17:00 - 2014-10-31 04:50 - 00814080 _____ (Microsoft Corporation)
     
  17. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    C:\windows\system32\jscript9diag.dll
    2015-02-16 17:00 - 2014-10-31 04:40 - 00033280 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll
    2015-02-16 17:00 - 2014-10-31 04:30 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
    2015-02-16 17:00 - 2014-10-31 04:29 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
    2015-02-16 17:00 - 2014-10-31 04:29 - 00087552 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx
    2015-02-16 17:00 - 2014-10-31 04:28 - 00107520 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
    2015-02-16 17:00 - 2014-10-31 04:25 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
    2015-02-16 17:00 - 2014-10-31 04:24 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll
    2015-02-16 17:00 - 2014-10-31 04:19 - 00152064 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
    2015-02-16 17:00 - 2014-10-31 03:42 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll
    2015-02-16 17:00 - 2014-10-31 03:28 - 00137728 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe
    2015-02-16 17:00 - 2014-10-31 03:28 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe
    2015-02-16 17:00 - 2014-10-31 03:27 - 00152064 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe
    2015-02-16 17:00 - 2014-10-31 03:26 - 00057344 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll
    2015-02-16 17:00 - 2014-10-31 03:25 - 00011264 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe
    2015-02-16 17:00 - 2014-10-31 03:24 - 00235520 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
    2015-02-16 17:00 - 2014-10-31 03:24 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
    2015-02-16 17:00 - 2014-10-31 03:23 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
    2015-02-16 17:00 - 2014-10-31 03:16 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
    2015-02-16 17:00 - 2014-10-31 03:15 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
    2015-02-16 17:00 - 2014-10-31 03:14 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll
    2015-02-16 17:00 - 2014-10-31 03:13 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
    2015-02-16 17:00 - 2014-10-31 03:13 - 00099328 _____ (Microsoft Corporation) C:\windows\SysWOW64\hlink.dll
    2015-02-16 17:00 - 2014-10-31 03:12 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
    2015-02-16 17:00 - 2014-10-31 03:11 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
    2015-02-16 17:00 - 2014-10-31 03:03 - 00027136 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll
    2015-02-16 17:00 - 2014-10-31 02:57 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
    2015-02-16 17:00 - 2014-10-31 02:56 - 00091136 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
    2015-02-16 17:00 - 2014-10-31 02:56 - 00090624 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
    2015-02-16 17:00 - 2014-10-31 02:56 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx
    2015-02-16 17:00 - 2014-10-31 02:53 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
    2015-02-16 17:00 - 2014-10-31 02:53 - 00052736 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll
    2015-02-16 17:00 - 2014-10-31 02:48 - 00130048 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
    2015-02-16 17:00 - 2014-10-31 02:26 - 01042944 _____ (Microsoft Corporation) C:\windows\SysWOW64\actxprxy.dll
    2015-02-16 17:00 - 2014-10-31 02:24 - 00040448 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll
    2015-02-16 17:00 - 2014-02-06 11:30 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
    2015-02-16 16:59 - 2015-01-10 09:10 - 07472960 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
    2015-02-16 16:59 - 2015-01-10 09:10 - 01733440 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
    2015-02-16 16:59 - 2015-01-10 08:28 - 01498360 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
    2015-02-16 16:59 - 2014-10-29 02:02 - 00285184 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
    2015-02-16 16:58 - 2015-01-19 18:42 - 01487976 _____ (Microsoft Corporation) C:\windows\system32\sppobjs.dll
    2015-02-16 16:58 - 2014-12-19 06:26 - 00140800 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
    2015-02-16 16:58 - 2014-12-12 02:04 - 00087040 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
    2015-02-16 16:58 - 2014-12-12 00:51 - 00075776 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ahcache.sys
    2015-02-16 16:58 - 2014-10-29 02:02 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
    2015-02-16 16:58 - 2014-10-29 01:57 - 00016896 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
    2015-02-16 16:58 - 2014-10-29 01:15 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
    2015-02-16 16:58 - 2014-10-29 01:15 - 00005632 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
    2015-02-16 16:58 - 2014-10-29 01:14 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
    2015-02-16 16:58 - 2014-10-29 01:13 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
    2015-02-16 16:58 - 2014-10-29 01:13 - 00008704 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
    2015-02-16 16:58 - 2014-10-23 05:48 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\packager.dll
    2015-02-16 16:58 - 2014-10-23 05:05 - 00072192 _____ (Microsoft Corporation) C:\windows\SysWOW64\packager.dll
    2015-02-16 16:58 - 2014-10-13 02:43 - 00238912 ____C (Microsoft Corporation) C:\windows\system32\Drivers\sdbus.sys
    2015-02-16 16:58 - 2014-10-13 02:43 - 00153920 ____C (Microsoft Corporation) C:\windows\system32\Drivers\dumpsd.sys
    2015-02-16 16:58 - 2014-10-13 02:43 - 00086336 _____ (Microsoft Corporation) C:\windows\system32\Drivers\pdc.sys
    2015-02-16 16:58 - 2014-10-13 02:43 - 00039744 ____C (Microsoft Corporation) C:\windows\system32\Drivers\intelpep.sys
    2015-02-16 16:58 - 2014-09-04 00:12 - 00590336 _____ (Microsoft Corporation) C:\windows\system32\rastls.dll
    2015-02-16 16:58 - 2014-09-04 00:01 - 00514048 _____ (Microsoft Corporation) C:\windows\SysWOW64\rastls.dll
    2015-02-16 16:58 - 2014-08-16 04:08 - 01507648 _____ (Microsoft Corporation) C:\windows\system32\propsys.dll
    2015-02-16 16:58 - 2014-08-16 03:58 - 01112512 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
    2015-02-16 16:58 - 2014-08-16 03:16 - 01205976 _____ (Microsoft Corporation) C:\windows\SysWOW64\propsys.dll
    2015-02-16 16:58 - 2014-08-16 01:31 - 00838144 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
    2015-02-16 16:58 - 2014-08-16 01:04 - 00359424 _____ (Microsoft Corporation) C:\windows\system32\Wldap32.dll
    2015-02-16 16:58 - 2014-08-16 00:58 - 00287744 _____ (Microsoft Corporation) C:\windows\system32\SystemEventsBrokerServer.dll
    2015-02-16 16:58 - 2014-08-16 00:53 - 00118272 _____ (Microsoft Corporation) C:\windows\system32\httpprxm.dll
    2015-02-16 16:58 - 2014-08-16 00:46 - 00290816 _____ (Microsoft Corporation) C:\windows\system32\ProximityService.dll
    2015-02-16 16:58 - 2014-08-16 00:45 - 00267776 _____ (Microsoft Corporation) C:\windows\system32\bisrv.dll
    2015-02-16 16:58 - 2014-08-16 00:43 - 00321024 _____ (Microsoft Corporation) C:\windows\SysWOW64\Wldap32.dll
    2015-02-16 16:58 - 2014-08-16 00:43 - 00075776 _____ (Microsoft Corporation) C:\windows\system32\adhsvc.dll
    2015-02-16 16:58 - 2014-08-16 00:31 - 00914432 _____ (Microsoft Corporation) C:\windows\system32\iphlpsvc.dll
    2015-02-16 16:58 - 2014-08-16 00:31 - 00286208 _____ (Microsoft Corporation) C:\windows\system32\pcsvDevice.dll
    2015-02-16 16:58 - 2014-08-16 00:29 - 00249344 _____ (Microsoft Corporation) C:\windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
    2015-02-16 16:58 - 2014-08-16 00:23 - 01106432 _____ (Microsoft Corporation) C:\windows\system32\SearchFolder.dll
    2015-02-16 16:58 - 2014-08-16 00:22 - 00717824 _____ (Microsoft Corporation) C:\windows\system32\SkyDriveTelemetry.dll
    2015-02-16 16:58 - 2014-08-16 00:22 - 00286208 _____ (Microsoft Corporation) C:\windows\system32\SkyDriveShell.dll
    2015-02-16 16:58 - 2014-08-16 00:19 - 00189952 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
    2015-02-16 16:58 - 2014-08-16 00:18 - 04758528 _____ (Microsoft Corporation) C:\windows\system32\SyncEngine.dll
    2015-02-16 16:58 - 2014-08-16 00:17 - 08757760 _____ (Microsoft Corporation) C:\windows\system32\Windows.UI.Search.dll
    2015-02-16 16:58 - 2014-08-16 00:14 - 00265216 _____ (Microsoft Corporation) C:\windows\SysWOW64\SkyDriveShell.dll
    2015-02-16 16:58 - 2014-08-16 00:13 - 06649344 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
    2015-02-16 16:58 - 2014-08-16 00:13 - 05902848 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.UI.Search.dll
    2015-02-16 16:58 - 2014-08-16 00:13 - 00840192 _____ (Microsoft Corporation) C:\windows\SysWOW64\SearchFolder.dll
    2015-02-16 16:58 - 2014-08-16 00:11 - 00920064 _____ (Microsoft Corporation) C:\windows\system32\WSShared.dll
    2015-02-16 16:58 - 2014-08-16 00:10 - 01120768 _____ (Microsoft Corporation) C:\windows\system32\SkyDrive.exe
    2015-02-16 16:58 - 2014-08-16 00:08 - 05777408 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
    2015-02-16 16:58 - 2014-08-16 00:07 - 00756224 _____ (Microsoft Corporation) C:\windows\SysWOW64\WSShared.dll
    2015-02-16 16:58 - 2014-08-02 00:18 - 01212928 _____ (Microsoft Corporation) C:\windows\system32\schedsvc.dll
    2015-02-16 16:58 - 2014-07-24 15:28 - 00468288 ____C (Microsoft Corporation) C:\windows\system32\Drivers\USBHUB3.SYS
    2015-02-16 16:58 - 2014-07-24 11:42 - 01200640 ____C (Microsoft Corporation) C:\windows\system32\Drivers\bthport.sys
    2015-02-16 16:58 - 2014-07-24 11:41 - 00115712 _____ (Microsoft Corporation) C:\windows\system32\Drivers\bridge.sys
    2015-02-16 16:58 - 2014-07-24 10:09 - 01057280 _____ (Microsoft Corporation) C:\windows\system32\rdvidcrl.dll
    2015-02-16 16:58 - 2014-07-24 09:27 - 00855552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rdvidcrl.dll
    2015-02-16 16:58 - 2014-07-15 18:16 - 03048880 _____ (Microsoft Corporation) C:\windows\system32\WpcMon.exe
    2015-02-16 16:58 - 2014-07-15 08:29 - 03118080 _____ (Microsoft Corporation) C:\windows\system32\Wpc.dll
    2015-02-16 16:58 - 2014-07-15 08:22 - 02861056 _____ (Microsoft Corporation) C:\windows\system32\WpcWebSync.dll
    2015-02-16 16:58 - 2014-07-15 08:03 - 02344448 _____ (Microsoft Corporation) C:\windows\SysWOW64\Wpc.dll
    2015-02-16 16:58 - 2014-05-01 13:31 - 00055328 _____ (Microsoft Corporation) C:\windows\system32\Drivers\wpcfltr.sys
    2015-02-16 16:58 - 2014-04-30 04:43 - 01975296 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll
    2015-02-16 16:58 - 2014-04-30 04:26 - 01345536 _____ (Microsoft Corporation) C:\windows\system32\FntCache.dll
    2015-02-16 16:58 - 2014-04-30 03:47 - 01509888 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll
    2015-02-16 16:57 - 2015-01-10 08:22 - 04175872 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
    2015-02-16 16:57 - 2014-11-09 23:19 - 00991232 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
    2015-02-16 16:57 - 2014-11-09 23:19 - 00806400 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
    2015-02-16 16:57 - 2014-11-09 23:18 - 00259584 _____ (Microsoft Corporation) C:\windows\system32\pku2u.dll
    2015-02-16 16:57 - 2014-11-09 23:18 - 00208896 _____ (Microsoft Corporation) C:\windows\SysWOW64\pku2u.dll
    2015-02-16 16:57 - 2014-09-10 06:25 - 00474432 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
    2015-02-16 16:57 - 2014-09-08 03:07 - 02497344 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
    2015-02-16 16:57 - 2014-09-08 03:07 - 00428864 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS
    2015-02-16 16:57 - 2014-09-04 22:30 - 00822272 _____ (Microsoft Corporation) C:\windows\system32\win32spl.dll
    2015-02-16 16:57 - 2014-09-04 22:21 - 01053184 _____ (Microsoft Corporation) C:\windows\system32\localspl.dll
    2015-02-16 16:57 - 2014-09-04 03:05 - 00836176 _____ (Microsoft Corporation) C:\windows\system32\mfmp4srcsnk.dll
    2015-02-16 16:57 - 2014-09-04 02:22 - 00670384 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfmp4srcsnk.dll
    2015-02-16 16:57 - 2014-09-04 01:01 - 00448512 _____ (Microsoft Corporation) C:\windows\system32\puiobj.dll
    2015-02-16 16:57 - 2014-09-04 00:32 - 00334336 _____ (Microsoft Corporation) C:\windows\SysWOW64\puiobj.dll
    2015-02-16 16:57 - 2014-09-04 00:10 - 00118272 _____ (Microsoft Corporation) C:\windows\system32\winbici.dll
    2015-02-16 16:57 - 2014-08-31 00:17 - 00148800 ____C (Microsoft Corporation) C:\windows\system32\Drivers\USBSTOR.SYS
    2015-02-16 16:57 - 2014-08-31 00:15 - 21197152 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
    2015-02-16 16:57 - 2014-08-30 22:59 - 18723112 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
    2015-02-16 16:57 - 2014-08-30 22:05 - 00615424 _____ (Microsoft Corporation) C:\windows\system32\FXSCOMEX.dll
    2015-02-16 16:57 - 2014-08-30 21:58 - 00275968 _____ (Microsoft Corporation) C:\windows\system32\FXSAPI.dll
    2015-02-16 16:57 - 2014-08-30 21:04 - 00941568 _____ (Microsoft Corporation) C:\windows\system32\MFMediaEngine.dll
    2015-02-16 16:57 - 2014-08-30 20:53 - 00239104 _____ (Microsoft Corporation) C:\windows\SysWOW64\FXSAPI.dll
    2015-02-16 16:57 - 2014-08-30 20:17 - 00799744 _____ (Microsoft Corporation) C:\windows\SysWOW64\MFMediaEngine.dll
    2015-02-16 16:57 - 2014-08-28 00:21 - 02480128 _____ (Microsoft Corporation) C:\windows\system32\WsmSvc.dll
    2015-02-16 16:57 - 2014-08-28 00:06 - 02030592 _____ (Microsoft Corporation) C:\windows\SysWOW64\WsmSvc.dll
    2015-02-16 16:57 - 2014-08-23 05:14 - 13424128 _____ (Microsoft Corporation) C:\windows\system32\twinui.dll
    2015-02-16 16:57 - 2014-08-23 05:04 - 11820544 _____ (Microsoft Corporation) C:\windows\SysWOW64\twinui.dll
    2015-02-16 16:57 - 2014-08-23 04:50 - 02714112 _____ (Microsoft Corporation) C:\windows\system32\SettingsHandlers.dll
    2015-02-16 16:57 - 2014-08-02 00:51 - 00545792 _____ (Microsoft Corporation) C:\windows\system32\untfs.dll
    2015-02-16 16:57 - 2014-08-02 00:35 - 00485376 _____ (Microsoft Corporation) C:\windows\SysWOW64\untfs.dll
    2015-02-16 16:57 - 2014-07-24 11:22 - 00308736 _____ (Microsoft Corporation) C:\windows\system32\compstui.dll
    2015-02-16 16:57 - 2014-07-24 09:53 - 00215552 _____ (Microsoft Corporation) C:\windows\system32\prnntfy.dll
    2015-02-16 16:57 - 2014-07-24 09:13 - 00195584 _____ (Microsoft Corporation) C:\windows\SysWOW64\prnntfy.dll
    2015-02-16 16:57 - 2014-07-24 08:20 - 00187392 _____ (Microsoft Corporation) C:\windows\system32\puiapi.dll
    2015-02-16 16:57 - 2014-07-24 08:08 - 00162816 _____ (Microsoft Corporation) C:\windows\SysWOW64\puiapi.dll
    2015-02-16 16:57 - 2014-07-24 07:49 - 00263680 _____ (Microsoft Corporation) C:\windows\system32\DafPrintProvider.dll
    2015-02-16 16:57 - 2014-07-24 07:43 - 00200192 _____ (Microsoft Corporation) C:\windows\SysWOW64\DafPrintProvider.dll
    2015-02-16 16:57 - 2014-07-24 03:20 - 00875688 _____ (Microsoft Corporation) C:\windows\SysWOW64\msvcr120_clr0400.dll
    2015-02-16 16:57 - 2014-07-24 03:20 - 00869544 _____ (Microsoft Corporation) C:\windows\system32\msvcr120_clr0400.dll
    2015-02-16 16:56 - 2015-02-03 23:38 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
    2015-02-16 16:56 - 2015-02-03 23:08 - 00761856 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
    2015-02-16 16:56 - 2015-02-03 23:08 - 00414208 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
    2015-02-16 16:56 - 2015-02-02 23:11 - 01098752 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
    2015-02-16 16:56 - 2015-02-02 23:11 - 00894464 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
    2015-02-16 16:56 - 2015-02-02 23:11 - 00609280 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
    2015-02-16 16:56 - 2014-12-08 19:42 - 00535640 _____ (Microsoft Corporation) C:\windows\system32\wer.dll
    2015-02-16 16:56 - 2014-12-08 19:42 - 00531616 _____ (Microsoft Corporation) C:\windows\system32\ci.dll
    2015-02-16 16:56 - 2014-12-08 19:42 - 00448792 _____ (Microsoft Corporation) C:\windows\SysWOW64\wer.dll
    2015-02-16 16:56 - 2014-12-08 19:42 - 00413248 _____ (Microsoft Corporation) C:\windows\system32\Faultrep.dll
    2015-02-16 16:56 - 2014-12-08 19:42 - 00372408 _____ (Microsoft Corporation) C:\windows\SysWOW64\Faultrep.dll
    2015-02-16 16:56 - 2014-12-08 19:42 - 00108944 _____ (Microsoft Corporation) C:\windows\system32\EncDump.dll
    2015-02-16 16:56 - 2014-12-08 19:42 - 00038264 _____ (Microsoft Corporation) C:\windows\system32\WerFaultSecure.exe
    2015-02-16 16:56 - 2014-12-08 19:42 - 00033584 _____ (Microsoft Corporation) C:\windows\SysWOW64\WerFaultSecure.exe
    2015-02-16 16:56 - 2014-12-06 03:17 - 00360448 _____ (Microsoft Corporation) C:\windows\system32\ncsi.dll
    2015-02-16 16:56 - 2014-12-06 01:41 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
    2015-02-16 16:56 - 2014-12-06 01:35 - 00229888 _____ (Microsoft Corporation) C:\windows\system32\AudioEndpointBuilder.dll
    2015-02-16 16:56 - 2014-12-02 23:09 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
    2015-02-16 16:56 - 2014-10-31 23:57 - 01091072 _____ (Microsoft Corporation) C:\windows\system32\MrmCoreR.dll
    2015-02-16 16:56 - 2014-10-31 23:47 - 00790528 _____ (Microsoft Corporation) C:\windows\SysWOW64\MrmCoreR.dll
    2015-02-16 16:56 - 2014-10-30 22:37 - 00129536 _____ (Microsoft Corporation) C:\windows\SysWOW64\poqexec.exe
    2015-02-16 16:56 - 2014-10-30 22:34 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\poqexec.exe
    2015-02-16 16:56 - 2014-10-29 04:00 - 00465320 _____ (Microsoft Corporation) C:\windows\system32\WerFault.exe
    2015-02-16 16:56 - 2014-10-29 04:00 - 00139984 _____ (Microsoft Corporation) C:\windows\system32\wermgr.exe
    2015-02-16 16:56 - 2014-10-29 03:52 - 00500016 _____ (Microsoft Corporation) C:\windows\system32\AudioSes.dll
    2015-02-16 16:56 - 2014-10-29 03:52 - 00482872 _____ (Microsoft Corporation) C:\windows\system32\AudioEng.dll
    2015-02-16 16:56 - 2014-10-29 03:52 - 00394120 _____ (Microsoft Corporation) C:\windows\system32\AUDIOKSE.dll
    2015-02-16 16:56 - 2014-10-29 03:52 - 00272248 _____ (Microsoft Corporation) C:\windows\system32\audiodg.exe
    2015-02-16 16:56 - 2014-10-29 03:12 - 00413136 _____ (Microsoft Corporation) C:\windows\SysWOW64\WerFault.exe
    2015-02-16 16:56 - 2014-10-29 03:12 - 00136296 _____ (Microsoft Corporation) C:\windows\SysWOW64\wermgr.exe
    2015-02-16 16:56 - 2014-10-29 03:07 - 00424544 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioEng.dll
    2015-02-16 16:56 - 2014-10-29 03:07 - 00370424 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioSes.dll
    2015-02-16 16:56 - 2014-10-29 03:07 - 00344536 _____ (Microsoft Corporation) C:\windows\SysWOW64\AUDIOKSE.dll
    2015-02-16 16:56 - 2014-10-29 02:44 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\werdiagcontroller.dll
    2015-02-16 16:56 - 2014-10-29 01:59 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\werdiagcontroller.dll
    2015-02-16 16:56 - 2014-10-29 01:24 - 00086016 _____ (Microsoft Corporation) C:\windows\system32\nlaapi.dll
    2015-02-16 16:56 - 2014-10-29 01:02 - 00911360 _____ (Microsoft Corporation) C:\windows\system32\audiosrv.dll
    2015-02-16 16:56 - 2014-10-29 01:01 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll
    2015-02-16 16:56 - 2014-07-12 04:17 - 00623616 _____ (Microsoft Corporation) C:\windows\system32\MDMAgent.exe
    2015-02-16 16:56 - 2014-06-06 13:04 - 00586240 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
    2015-02-16 16:56 - 2014-06-06 12:18 - 00488960 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
    2015-02-16 16:56 - 2014-06-02 02:10 - 00423768 _____ (Microsoft Corporation) C:\windows\system32\hal.dll
    2015-02-16 16:56 - 2014-05-31 10:07 - 00440664 ____C (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
    2015-02-16 16:56 - 2014-05-31 10:07 - 00089944 ____C (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
    2015-02-16 16:56 - 2014-05-31 10:07 - 00027480 ____C (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
    2015-02-16 16:56 - 2014-05-31 06:30 - 00037376 ____C (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
    2015-02-16 16:56 - 2014-05-31 06:27 - 00110592 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WUDFPf.sys
    2015-02-16 16:56 - 2014-05-31 06:26 - 00227840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WUDFRd.sys
    2015-02-16 16:56 - 2014-05-31 04:01 - 00284672 _____ (Microsoft Corporation) C:\windows\system32\WUDFHost.exe
    2015-02-16 16:56 - 2014-05-31 04:01 - 00209408 _____ (Microsoft Corporation) C:\windows\system32\WUDFPlatform.dll
    2015-02-16 16:56 - 2014-05-31 04:01 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\WUDFSvc.dll
    2015-02-16 16:56 - 2014-05-27 09:56 - 00323584 _____ (Microsoft Corporation) C:\windows\system32\DaOtpCredentialProvider.dll
    2015-02-16 16:56 - 2014-05-27 09:53 - 00270848 _____ (Microsoft Corporation) C:\windows\SysWOW64\DaOtpCredentialProvider.dll
    2015-02-16 16:56 - 2014-05-01 05:24 - 02834944 _____ (Microsoft Corporation) C:\windows\system32\wpccpl.dll
    2015-02-16 16:50 - 2014-05-31 10:06 - 00555736 _____ (Microsoft Corporation) C:\windows\system32\twinapi.appcore.dll
    2015-02-16 16:50 - 2014-05-31 02:37 - 01054208 _____ (Microsoft Corporation) C:\windows\system32\twinui.appcore.dll
    2015-02-16 16:50 - 2014-05-31 02:35 - 00828928 _____ (Microsoft Corporation) C:\windows\SysWOW64\twinui.appcore.dll
    2015-02-16 16:46 - 2015-02-16 16:46 - 00000000 ____H () C:\windows\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
    2015-02-16 15:12 - 2015-02-16 15:12 - 00000000 ____D () C:\Users\Damien\AppData\Local\CyberLink
    2015-02-16 11:47 - 2015-02-18 10:17 - 00000000 ____D () C:\ProgramData\CloudBerry Online Backup
    2015-02-16 10:39 - 2015-03-04 06:57 - 00004982 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for LENOVO-PC-Damien Lenovo-PC
    2015-02-16 10:39 - 2015-02-16 10:39 - 00003100 _____ () C:\windows\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1301979038-2669888510-292050220-1002
    2015-02-16 10:39 - 2015-02-16 10:39 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
    2015-02-16 10:33 - 2015-02-27 05:33 - 00000000 ____D () C:\Program Files\Microsoft Office 15
    2015-02-16 10:33 - 2015-02-16 10:33 - 01062064 _____ (Microsoft Corporation) C:\Users\Damien\Downloads\Setup.X86.en-US_O365HomePremRetail_48a0bc06-01de-4441-865e-132443b69257_TX_DB_(1).exe
    2015-02-16 10:23 - 2015-02-16 10:23 - 01062064 _____ (Microsoft Corporation) C:\Users\Damien\Downloads\Setup.X86.en-US_O365HomePremRetail_48a0bc06-01de-4441-865e-132443b69257_TX_DB_.exe
    2015-02-16 09:26 - 2014-11-26 03:53 - 04608320 _____ (SafeNet Inc.) C:\windows\system32\hasplms.exe
    2015-02-16 09:25 - 2015-02-16 09:25 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Marshall Day Acoustics
    2015-02-16 09:25 - 2015-02-16 09:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Insul
    2015-02-16 09:25 - 2015-02-16 09:25 - 00000000 ____D () C:\ProgramData\Marshall Day Acoustics
    2015-02-16 09:25 - 2015-02-16 09:25 - 00000000 ____D () C:\Program Files (x86)\Marshall Day Acoustics
    2015-02-16 09:22 - 2015-02-16 09:24 - 09809100 _____ (Marshall Day Acoustics ) C:\Users\Damien\Downloads\setup8006.exe
    2015-02-15 22:11 - 2015-02-15 22:11 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\My Bluetooth
    2015-02-15 21:32 - 2015-02-15 21:32 - 00137560 _____ () C:\Users\Damien\Downloads\DELL_E207WFP_A00-00_R211140(1).EXE
    2015-02-15 21:27 - 2015-02-15 21:33 - 00000000 ____D () C:\Dell
    2015-02-15 21:26 - 2015-02-15 21:26 - 00137560 _____ () C:\Users\Damien\Downloads\DELL_E207WFP_A00-00_R211140.EXE
    2015-02-15 21:11 - 2015-02-15 21:11 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
    2015-02-15 21:05 - 2013-12-31 12:05 - 00034244 _____ () C:\Users\Damien\Desktop\AA Invoice List - Rev 1.xlsx
    2015-02-15 21:05 - 2013-12-13 12:04 - 00720733 _____ () C:\Users\Damien\Desktop\Impact Test Sheet.xltm
    2015-02-15 21:05 - 2013-12-13 12:03 - 00675205 _____ () C:\Users\Damien\Desktop\Airborne Test Sheet.xltm
    2015-02-15 21:05 - 2013-07-12 10:10 - 00024305 _____ () C:\Users\Damien\Desktop\format data macro.xlsm
    2015-02-15 21:05 - 2012-08-14 19:01 - 00000066 _____ () C:\Users\Damien\Desktop\Wireless Network Keys.txt
    2015-02-15 21:05 - 2011-09-08 08:21 - 00018325 _____ () C:\Users\Damien\Desktop\Acoustics_addin.xlam
    2015-02-15 21:03 - 2015-02-15 21:03 - 00000000 ____D () C:\Users\Damien\AppData\Local\Macromedia
    2015-02-15 21:02 - 2015-02-19 19:22 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Dropbox
    2015-02-15 21:02 - 2015-02-15 21:02 - 00355464 _____ (Dropbox, Inc.) C:\Users\Damien\Downloads\DropboxInstaller.exe
    2015-02-15 21:00 - 2015-03-04 06:54 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
    2015-02-15 21:00 - 2015-02-15 21:00 - 00003718 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
    2015-02-15 20:57 - 2015-02-15 21:01 - 00000000 ____D () C:\Users\Damien\AppData\Local\Adobe
    2015-02-15 19:46 - 2008-01-15 16:35 - 00297120 _____ (Bluebeam Software, Inc.) C:\windows\system32\BBPdfPortMon.DLL
    2015-02-15 19:45 - 2015-02-15 19:45 - 00002070 _____ () C:\Users\Public\Desktop\Bluebeam PDF Revu.lnk
    2015-02-15 19:45 - 2015-02-15 19:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bluebeam Software
    2015-02-15 19:27 - 2015-02-15 19:27 - 00000000 ____D () C:\windows\System32\Tasks\OfficeSoftwareProtectionPlatform
    2015-02-15 19:23 - 2015-02-15 19:23 - 01055936 _____ (Adobe) C:\Users\Damien\Downloads\install_flashplayer16x32_mssd_aaa_aih.exe
    2015-02-15 19:20 - 2015-02-15 19:20 - 00002064 _____ () C:\Users\Public\Desktop\Norsonic NorXfer 5.0.lnk
    2015-02-15 19:20 - 2015-02-15 19:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norsonic
    2015-02-15 19:20 - 2004-04-26 14:10 - 00103744 _____ (Microsoft Corporation) C:\windows\SysWOW64\MSCOMM32.OCX
    2015-02-15 19:20 - 2004-03-09 16:45 - 01081616 _____ (Microsoft Corporation) C:\windows\SysWOW64\MSCOMCTL.OCX
    2015-02-15 19:20 - 2004-03-09 16:45 - 00152848 _____ (Microsoft Corporation) C:\windows\SysWOW64\COMDLG32.OCX
    2015-02-15 19:20 - 1998-06-24 00:00 - 00067376 _____ (Microsoft Corporation) C:\windows\SysWOW64\SYSINFO.OCX
    2015-02-15 19:19 - 2015-02-15 19:19 - 00001639 _____ () C:\Users\Damien\Desktop\dB23 - Shortcut.lnk
    2015-02-15 19:18 - 2015-02-15 19:18 - 00303616 _____ (InstallShield Software Corporation) C:\windows\IsUninst.exe
    2015-02-15 19:18 - 2015-02-15 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CEL SoundTrack
    2015-02-15 19:18 - 2003-02-27 16:08 - 00024576 ____N (Microsoft Corporation) C:\windows\SysWOW64\Rsrc32.dll
    2015-02-15 19:18 - 2003-02-27 16:08 - 00001312 ____N (Microsoft Corporation) C:\windows\SysWOW64\rsrc16.dll
    2015-02-15 19:15 - 2015-02-15 19:17 - 00000000 ____D () C:\Users\Damien\Downloads\Copy Files (4AZxlZTikUK2)
    2015-02-15 19:14 - 2015-02-15 19:14 - 00002276 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\WinZip.lnk
    2015-02-15 19:14 - 2015-02-15 19:14 - 00002270 _____ () C:\Users\Public\Desktop\WinZip.lnk
    2015-02-15 19:14 - 2015-02-15 19:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
    2015-02-15 18:23 - 2015-02-15 18:23 - 00000000 ____D () C:\Users\Damien\AppData\Local\Bluebeam Software
    2015-02-15 18:14 - 2015-02-15 18:14 - 00000000 ____D () C:\ProgramData\Mozilla
    2015-02-15 18:11 - 2015-02-15 19:44 - 00000000 ____D () C:\Program Files\Bluebeam Software
    2015-02-15 18:11 - 2015-02-15 18:23 - 00000000 ____D () C:\ProgramData\Bluebeam Software
    2015-02-15 18:11 - 2015-02-15 18:11 - 00000000 ____D () C:\Program Files\Common Files\Bluebeam Software
    2015-02-15 17:47 - 2015-02-16 09:24 - 00000000 ____D () C:\Users\Damien\AppData\Local\Downloaded Installations
    2015-02-15 17:46 - 2015-02-15 19:51 - 00000000 ____D () C:\Users\Damien\Downloads\BbPDFRevuStandard654_with_activation_info
    2015-02-15 15:26 - 2015-02-15 15:26 - 00000000 ____D () C:\windows\PCHEALTH
    2015-02-15 15:26 - 2015-02-15 15:26 - 00000000 ____D () C:\Program Files\Microsoft Sync Framework
    2015-02-15 15:26 - 2015-02-15 15:26 - 00000000 ____D () C:\Program Files\Microsoft SQL Server Compact Edition
    2015-02-15 15:24 - 2015-02-20 19:57 - 00000000 ____D () C:\Users\Damien\AppData\Local\Microsoft Help
    2015-02-15 15:24 - 2015-02-16 10:27 - 00000000 ____D () C:\ProgramData\Microsoft Help
    2015-02-15 15:24 - 2015-02-16 10:26 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 8
    2015-02-15 15:24 - 2015-02-15 15:26 - 00000000 ____D () C:\Program Files\Microsoft Office
    2015-02-15 15:24 - 2015-02-15 15:24 - 00000000 ____D () C:\Program Files\Microsoft Analysis Services
    2015-02-15 15:24 - 2015-02-15 15:24 - 00000000 ____D () C:\Program Files (x86)\Microsoft Analysis Services
    2015-02-15 14:30 - 2015-02-15 19:20 - 00000000 _____ () C:\debugFileIfDb.log
    2015-02-15 14:30 - 2015-02-15 14:30 - 00000000 ____D () C:\Program Files (x86)\Norsonic
    2015-02-15 14:25 - 2015-02-15 14:25 - 00000000 ____D () C:\Program Files (x86)\Casella Group Ltd
    2015-02-15 14:23 - 2015-02-15 19:14 - 00000000 ____D () C:\ProgramData\WinZip
    2015-02-15 14:22 - 2015-02-15 19:14 - 00000000 ____D () C:\Program Files (x86)\WinZip
    2015-02-15 14:18 - 2015-02-15 14:18 - 00000000 ____D () C:\Users\Damien\Downloads\WinZip PRO FINAL v15.0 + Serials [ChattChitto RG]
    2015-02-15 14:15 - 2015-02-15 14:15 - 00000871 _____ () C:\Users\Damien\Desktop\µTorrent.lnk
    2015-02-15 14:15 - 2015-02-15 14:15 - 00000851 _____ () C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
    2015-02-15 14:13 - 2015-03-03 07:51 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\uTorrent
    2015-02-15 14:13 - 2015-02-15 14:13 - 01742416 _____ (BitTorrent Inc.) C:\Users\Damien\Downloads\uTorrent.exe
    2015-02-15 14:10 - 2015-02-15 14:10 - 00000000 ____D () C:\Users\Damien\Downloads\The Ultimate Forex Manual for Successful Forex Trading
    2015-02-15 14:10 - 2015-02-15 14:10 - 00000000 ____D () C:\Users\Damien\Downloads\dB23 Software v.1.07
    2015-02-15 14:10 - 2014-09-28 19:20 - 01288472 _____ (MetaQuotes Software Corp.) C:\Users\Damien\Downloads\mt4setup.exe
    2015-02-15 14:10 - 2014-06-27 08:48 - 765883568 _____ (Microsoft Corporation) C:\Users\Damien\Downloads\officesp2010-kb2687455-fullfile-x64-en-us.exe
    2015-02-15 14:10 - 2014-05-06 19:51 - 01380784 _____ (Autodesk, Inc.) C:\Users\Damien\Downloads\AutodeskDesignRevSetup.exe
    2015-02-15 14:10 - 2014-03-27 20:46 - 45256577 _____ () C:\Users\Damien\Downloads\BbPDFRevuStandard654_with_activation_info.rar
    2015-02-15 14:10 - 2014-03-10 11:20 - 12769728 _____ () C:\Users\Damien\Downloads\CloudBerryOnlineBackupSetup_v3.7.1.27S3netv4.0.exe
    2015-02-15 14:10 - 2013-06-20 15:01 - 29957224 _____ (Norsonic AS) C:\Users\Damien\Downloads\NorXfer5.0.1.10.exe
    2015-02-15 14:10 - 2013-06-20 14:42 - 00781776 _____ (Google Inc.) C:\Users\Damien\Downloads\ChromeSetup.exe
    2015-02-15 13:44 - 2014-12-31 11:14 - 00298120 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
    2015-02-15 13:34 - 2015-02-15 15:14 - 1464598506 _____ () C:\Users\Damien\Downloads\Copy Files (4AZxlZTikUK2).zip
    2015-02-15 13:13 - 2015-02-15 13:13 - 00000000 ____D () C:\Users\Public\Pokki
    2015-02-15 13:12 - 2015-02-23 17:16 - 00002302 _____ () C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
    2015-02-15 13:12 - 2015-02-15 13:12 - 00002362 _____ () C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo Web Start.lnk
    2015-02-15 13:12 - 2015-02-15 13:12 - 00002131 _____ () C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk
    2015-02-15 12:48 - 2015-02-25 19:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
    2015-02-15 12:48 - 2015-02-15 18:49 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Mozilla
    2015-02-15 12:48 - 2015-02-15 18:49 - 00000000 ____D () C:\Users\Damien\AppData\Local\Mozilla
    2015-02-15 12:48 - 2015-02-15 12:48 - 00001182 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
    2015-02-15 12:48 - 2015-02-15 12:48 - 00001170 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
    2015-02-15 12:46 - 2015-03-04 06:32 - 00003934 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{1318194E-A6D2-40EF-BB41-4BDB4B0A2766}
    2015-02-15 12:46 - 2015-02-15 12:46 - 00000000 __SHD () C:\Users\Damien\AppData\Local\EmieUserList
    2015-02-15 12:46 - 2015-02-15 12:46 - 00000000 __SHD () C:\Users\Damien\AppData\Local\EmieSiteList
    2015-02-15 12:43 - 2015-02-15 12:43 - 00000000 ____D () C:\Users\Damien\AppData\Local\Lenovo
    2015-02-15 12:42 - 2015-03-04 07:08 - 00003598 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1301979038-2669888510-292050220-1002
    2015-02-15 12:42 - 2015-03-04 06:57 - 00000000 ___DO () C:\Users\Damien\OneDrive
    2015-02-15 12:39 - 2015-02-15 12:39 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Intel Corporation
    2015-02-15 12:37 - 2015-02-17 00:12 - 00000000 ____D () C:\windows\System32\Tasks\WPD
    2015-02-15 12:37 - 2015-02-15 13:09 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Hightail for Lenovo
    2015-02-15 12:36 - 2015-02-24 10:58 - 00000000 ____D () C:\Users\Damien\AppData\Local\VirtualStore
    2015-02-15 12:36 - 2015-02-15 12:36 - 00001453 _____ () C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
    2015-02-15 12:36 - 2015-02-15 12:36 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Macromedia
    2015-02-15 12:36 - 2015-02-15 12:36 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Adobe
    2015-02-15 12:35 - 2015-03-04 07:21 - 00075406 _____ () C:\Users\Damien\AppData\Local\BTServer.log
    2015-02-15 12:35 - 2015-02-22 22:48 - 00000000 ____D () C:\Users\Damien\AppData\Local\Packages
    2015-02-15 12:35 - 2015-02-15 12:35 - 00001260 _____ () C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BTServer Toasts App.lnk
    2015-02-15 12:35 - 2015-02-15 12:35 - 00000139 _____ () C:\Users\Public\Desktop\eBay.url
    2015-02-15 12:35 - 2015-02-15 12:35 - 00000000 ____D () C:\Users\Damien\Documents\My Bluetooth
    2015-02-15 12:35 - 2015-02-15 12:35 - 00000000 ____D () C:\ProgramData\eBay
    2015-02-15 12:32 - 2015-03-02 14:34 - 00000000 ____D () C:\Users\Damien\AppData\Local\Pokki
    2015-02-15 12:32 - 2015-02-27 19:28 - 00000000 ____D () C:\Users\Damien
    2015-02-15 12:32 - 2015-02-15 12:32 - 00000020 ___SH () C:\Users\Damien\ntuser.ini
    2015-02-15 12:32 - 2014-08-17 16:06 - 00000126 _____ () C:\Users\Damien\Desktop\Adobe Photo Offer.url
    2015-02-15 12:32 - 2014-08-17 15:18 - 00000000 ___RD () C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
    2015-02-15 12:32 - 2014-03-26 10:21 - 00000190 _____ () C:\Users\Damien\Desktop\FREE CALLS with Voxox.url
    2015-02-15 12:32 - 2014-03-18 10:05 - 00000000 ___RD () C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
    2015-02-15 12:32 - 2014-03-18 09:55 - 00000369 _____ () C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
    2015-02-15 12:32 - 2014-03-18 09:55 - 00000369 _____ () C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
    2015-02-15 12:32 - 2013-08-22 15:36 - 00000000 ___RD () C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
    2015-02-15 12:32 - 2013-08-22 15:36 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-03-04 07:08 - 2014-08-17 15:09 - 01186796 _____ () C:\windows\WindowsUpdate.log
    2015-03-04 07:03 - 2014-03-18 09:53 - 00865408 _____ () C:\windows\system32\PerfStringBackup.INI
    2015-03-04 07:00 - 2013-08-22 15:36 - 00000000 ____D () C:\windows\system32\sru
    2015-03-04 06:55 - 2013-08-22 14:46 - 00033404 _____ () C:\windows\setupact.log
    2015-03-04 06:55 - 2013-08-22 14:45 - 00000006 ____H () C:\windows\Tasks\SA.DAT
    2015-03-04 06:55 - 2013-08-22 14:44 - 00562848 _____ () C:\windows\system32\FNTCACHE.DAT
    2015-03-04 06:54 - 2014-08-17 16:15 - 00002560 _____ () C:\windows\system32\VfService.trf
    2015-03-04 06:54 - 2014-08-17 16:08 - 00000000 ____D () C:\Program Files (x86)\Lenovo
    2015-03-04 06:54 - 2014-08-17 15:38 - 01150754 _____ () C:\Users\Public\CAFADEBUG.log
    2015-03-04 06:54 - 2013-08-22 13:25 - 00262144 ___SH () C:\windows\system32\config\BBI
    2015-03-02 16:45 - 2014-03-18 09:44 - 00013572 _____ () C:\windows\PFRO.log
    2015-03-02 16:10 - 2013-08-22 15:36 - 00000000 ___RD () C:\windows\Offline Web Pages
    2015-03-02 09:04 - 2014-08-17 16:08 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
    2015-02-27 19:39 - 2013-08-22 15:36 - 00000000 ____D () C:\windows\PLA
    2015-02-26 05:49 - 2013-08-22 15:36 - 00000000 ____D () C:\windows\AppReadiness
    2015-02-25 12:23 - 2012-08-13 20:07 - 00000000 ____D () C:\Users\Damien\Downloads\Game of Thrones - The Complete Season 2 [HDTV] + EXTRA
    2015-02-25 12:21 - 2012-08-13 20:18 - 00000000 ____D () C:\Users\Damien\Downloads\Inception[2010]DvDrip[Eng]-FXG
    2015-02-25 09:16 - 2014-08-17 16:19 - 00000000 ____D () C:\ProgramData\Energy Manager
    2015-02-20 10:58 - 2013-08-22 15:36 - 00000000 ____D () C:\windows\rescache
    2015-02-19 19:06 - 2014-03-18 09:38 - 00000000 ____D () C:\Program Files\Windows Journal
    2015-02-19 19:06 - 2013-08-22 15:36 - 00000000 ___RD () C:\windows\ToastData
    2015-02-19 19:06 - 2013-08-22 15:36 - 00000000 ___RD () C:\windows\ImmersiveControlPanel
    2015-02-19 19:06 - 2013-08-22 15:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
    2015-02-19 19:06 - 2013-08-22 15:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
    2015-02-19 19:06 - 2013-08-22 15:36 - 00000000 ____D () C:\windows\SysWOW64\setup
    2015-02-19 19:06 - 2013-08-22 15:36 - 00000000 ____D () C:\windows\SysWOW64\InputMethod
    2015-02-19 19:06 - 2013-08-22 15:36 - 00000000 ____D () C:\windows\system32\setup
    2015-02-19 19:06 - 2013-08-22 13:36 - 00000000 ____D () C:\windows\system32\oobe
    2015-02-18 07:37 - 2013-08-22 15:20 - 00000000 ____D () C:\windows\CbsTemp
    2015-02-17 12:22 - 2013-08-22 15:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
    2015-02-17 12:22 - 2013-08-22 15:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
    2015-02-17 12:22 - 2013-08-22 15:36 - 00000000 ____D () C:\windows\system32\sr-Latn-RS
    2015-02-17 12:22 - 2013-08-22 15:36 - 00000000 ____D () C:\windows\system32\sr-Latn-CS
    2015-02-17 12:22 - 2013-08-22 15:36 - 00000000 ____D () C:\windows\MediaViewer
    2015-02-17 12:22 - 2013-08-22 15:36 - 00000000 ____D () C:\windows\FileManager
    2015-02-17 12:22 - 2013-08-22 15:36 - 00000000 ____D () C:\windows\Camera
    2015-02-17 12:22 - 2013-08-22 15:36 - 00000000 ____D () C:\Program Files\Windows Defender
    2015-02-17 12:22 - 2013-08-22 15:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
    2015-02-17 12:21 - 2013-08-22 15:36 - 00000000 ____D () C:\windows\WinStore
    2015-02-17 12:21 - 2013-08-22 15:36 - 00000000 ____D () C:\windows\PolicyDefinitions
    2015-02-17 12:21 - 2013-08-22 15:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
    2015-02-17 06:28 - 2014-08-17 15:33 - 00000000 ____D () C:\ProgramData\Package Cache
    2015-02-16 15:12 - 2014-08-17 16:15 - 00000000 ____D () C:\ProgramData\CyberLink
    2015-02-16 10:26 - 2014-04-03 18:24 - 00000000 ____D () C:\Program Files (x86)\MSBuild
    2015-02-16 10:26 - 2014-03-18 09:38 - 00000000 ____D () C:\windows\ShellNew
    2015-02-16 10:26 - 2013-08-22 15:36 - 00000000 ____D () C:\Program Files\Common Files\System
    2015-02-16 10:26 - 2013-08-22 13:25 - 00000076 _____ () C:\windows\win.ini
    2015-02-15 20:51 - 2014-08-17 16:13 - 00000000 ____D () C:\Users\Public\Documents\Open Labs Library
    2015-02-15 19:06 - 2014-08-17 16:18 - 00000000 ____D () C:\ProgramData\Office2013
    2015-02-15 18:59 - 2013-08-22 13:36 - 00000000 ____D () C:\windows\system32\Sysprep
    2015-02-15 18:50 - 2013-08-22 15:36 - 00000000 ____D () C:\windows\registration
    2015-02-15 13:45 - 2013-08-22 13:25 - 00262144 ___SH () C:\windows\system32\config\ELAM
    2015-02-15 13:18 - 2014-08-17 16:09 - 00000000 ____D () C:\ProgramData\McAfee
    2015-02-15 13:16 - 2013-08-22 15:36 - 00000000 ___HD () C:\windows\ELAMBKUP
    2015-02-15 12:42 - 2014-08-17 16:08 - 00000000 ____D () C:\windows\System32\Tasks\Lenovo
    2015-02-15 12:40 - 2014-08-17 16:08 - 00000000 ____D () C:\ProgramData\Lenovo
    2015-02-15 12:36 - 2014-08-17 16:01 - 00123640 ____H () C:\windows\modules.log
    2015-02-15 12:36 - 2014-04-03 19:15 - 00000000 ____D () C:\windows\Panther

    ==================== Files in the root of some directories =======

    2015-01-25 16:12 - 2015-01-25 16:12 - 0002086 _____ () C:\Users\Damien\AppData\Roaming\OAUOK
    2015-01-25 16:12 - 2015-01-25 16:12 - 0001248 _____ () C:\Users\Damien\AppData\Roaming\REHXZDZS
    2015-02-15 12:35 - 2015-03-04 07:21 - 0075406 _____ () C:\Users\Damien\AppData\Local\BTServer.log
    2015-02-27 19:36 - 2015-02-27 19:36 - 0628504 _____ (CMI Limited) C:\Users\Damien\AppData\Local\nsuDDF9.tmp
    2014-08-17 15:38 - 2014-08-17 15:38 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

    Some content of TEMP:
    ====================
    C:\Users\Damien\AppData\Local\Temp\dllnt_dump.dll
    C:\Users\Damien\AppData\Local\Temp\Quarantine.exe
    C:\Users\Damien\AppData\Local\Temp\sqlite3.dll


    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2015-03-03 02:23

    ==================== End Of Log ============================
     
  18. Broni

    Broni Malware Annihilator Posts: 52,898   +344

    [​IMG] I can see two sources of Pokki on your computer.
    One is Lenovo preinstalled crap, Lenovo Web Start.
    The other one is Start Menu.
    Uninstall both.
    Let me know if successful and we'll go from there.
     
  19. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    When I try to uninstall either it does nothing only open up C:\windows\system32 folder!
     
  20. Broni

    Broni Malware Annihilator Posts: 52,898   +344

    OK, first let's see if Revo will take care of them.

    Revo Uninstaller is more thorough in deleting programs on your computer than using the Add/Remove option in Windows. Since it is a more powerful tool, please be sure to follow the instructions carefully.

    Please note there is a chance when you look for this program to uninstall through Revo it might not be listed because of the previous uninstall. If that is the case simply stop and let me know.
    • Please download and install Revo Uninstaller Free
    • Double click Revo Uninstaller to run it.
    • From the list of programs double click on the program you want to remove
    • When prompted if you want to uninstall click Yes.
    • Be sure the Moderate option is selected then click Next.
    • The program will run, If prompted again click Yes
    • When the built-in uninstaller is finished click on Next
    • Once the program has searched for leftovers click Next.
    • Check the items in bold only on the list then click Delete. You may have to expand some folders by clicking the "+" mark.
    • When prompted click on Yes and then on Next.
    • Put a check on any folders that are found and select Delete
    • When prompted select Yes then Next
    • Once done click Finish.
     
  21. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    Thanks Broni,

    Uninstalled both through Revo but they dont seem to have been removed as the Home/Start button still redirects.

    upload_2015-3-5_23-10-4.png
     
  22. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    I was about to install Pokki and see if I could reinstall again. Would this work?
     
  23. Broni

    Broni Malware Annihilator Posts: 52,898   +344

    OK, re-run FRST and post fresh log.
     
  24. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-03-2015
    Ran by Damien (administrator) on LENOVO-PC on 05-03-2015 23:16:28
    Running from C:\Users\Damien\Desktop
    Loaded Profiles: UpdatusUser & Damien (Available profiles: UpdatusUser & Damien & Damien_2)
    Platform: Windows 8.1 (X64) OS Language: English (United States)
    Internet Explorer Version 11 (Default browser: FF)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
    (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    (Microsoft Corporation) C:\Windows\System32\wlanext.exe
    () C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
    (CloudBerry Lab Inc.) C:\Program Files (x86)\CloudBerryLab\CloudBerry Online Backup\CloudBerry.Backup.Scheduler.exe
    (Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
    (Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\Dragon Assistant\Core\DACore.exe
    () C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\nsk596B.tmpfs
    (Microsoft Corporation) C:\Windows\System32\dasHost.exe
    (SafeNet Inc.) C:\Windows\System32\hasplms.exe
    (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
    () C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\jnsi86BB.tmp
    (LENOVO INCORPORATED.) C:\Program Files\lenovo\iMController\SystemAgentService.exe
    (Lenovo(beijing) Limited) C:\Windows\System32\LenovoWiFiHotspotSvr.exe
    (Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
    (Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
    () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
    (Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
    (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
    () C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
    (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
    (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
    (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
    (Intel Corporation) C:\Windows\System32\igfxtray.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Intel Corporation) C:\Windows\System32\igfxsrvc.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
    (Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe
    (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
    () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
    (Lenovo) C:\Program Files\lenovo\Onekey Theater\OnekeyStudio.exe
    (Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
    (Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
    (Bluebeam Software, Inc.) C:\Program Files\Common Files\Bluebeam Software\Brewery\V45\Printer Support\BBPrint.exe
    (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIIXE.EXE
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
    (CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE
    (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
    (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-10-17] (NVIDIA Corporation)
    HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
    HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [216064 2014-01-06] (Realtek Semiconductor Corporation)
    HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [907480 2013-09-05] (Conexant Systems, Inc.)
    HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
    HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
    HKLM\...\Run: [OnekeyStudio] => C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe [4196432 2012-09-14] (Lenovo)
    HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-08-17] (Lenovo(beijing) Limited)
    HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-08-17] (Lenovo(beijing) Limited)
    HKLM\...\Run: [BbPrintMonitor] => C:\Program Files\Common Files\Bluebeam Software\Brewery\V45\Printer Support\BBPrint.exe [211616 2008-01-15] (Bluebeam Software, Inc.)
    HKLM\...\Run: [BbInstallUser] => C:\Program Files\Bluebeam Software\Pushbutton PDF\Bluebeam Admin User.exe [49824 2008-11-25] (Bluebeam Software, Inc.)
    HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-07] (CyberLink Corp.)
    HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
    Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
    Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
    HKU\S-1-5-21-1301979038-2669888510-292050220-1002\...\Run: [EPLTarget\P0000000000000000] => C:\windows\system32\spool\DRIVERS\x64\3\E_YATIIXE.EXE [283232 2015-01-07] (SEIKO EPSON CORPORATION)
    HKU\S-1-5-21-1301979038-2669888510-292050220-1002\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\system32\Cities.scr
    Startup: C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
    ShortcutTarget: Dropbox.lnk -> C:\Users\Damien\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Damien\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
    ShellIconOverlayIdentifiers: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
    ShellIconOverlayIdentifiers: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
    ShellIconOverlayIdentifiers: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files\Hightail\Hightail for Lenovo\YSINSE64.dll (Hightail Inc.)
    ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\windows\system32\AcSignIcon.dll (Autodesk, Inc.)
    ShellIconOverlayIdentifiers-x32: [00001LenovoSyncComplete] -> {1E9CED2C-E7B4-4C47-B07A-25416393B67B} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
    ShellIconOverlayIdentifiers-x32: [00002LenovoSyncActive] -> {C1285F4D-918F-4EF2-BC94-CAD5B118C835} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
    ShellIconOverlayIdentifiers-x32: [00003LenovoSyncError] -> {CE5633DA-1488-4D1D-9A9B-B500297D4A8C} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
    ShellIconOverlayIdentifiers-x32: [00004LenovoLocalOnly] -> {C7362DA9-D3AC-4C17-B2F5-2F1823FA04C3} => C:\Program Files (x86)\Hightail\Hightail for Lenovo\YSINSE.dll (Hightail Inc.)
    BootExecute: autocheck autochk * sdnclean64.exe

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKU\S-1-5-21-1301979038-2669888510-292050220-1002\Software\Microsoft\Internet Explorer\Main,Start Page = http://lenovo13.msn.com/?pc=LCJB
    HKU\S-1-5-21-1301979038-2669888510-292050220-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com/?pc=LCJB
    HKU\S-1-5-21-1301979038-2669888510-292050220-1002\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com
    HKU\S-1-5-21-1301979038-2669888510-292050220-1002\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.lenovo.com
    URLSearchHook: [S-1-5-21-1301979038-2669888510-292050220-1001] ATTENTION ==> Default URLSearchHook is missing.
    SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKU\S-1-5-21-1301979038-2669888510-292050220-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
    BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
    Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
    Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    Tcpip\Parameters: [DhcpNameServer] 194.168.4.100 194.168.8.100

    FireFox:
    ========
    FF ProfilePath: C:\Users\Damien\AppData\Roaming\Mozilla\Firefox\Profiles\njojyi70.default-1425130353550
    FF Homepage: hxxp://www.bing.com/
    FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
    FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll (Nitro PDF)
    FF Plugin HKU\S-1-5-21-1301979038-2669888510-292050220-1002: pokki.com/PokkiDownloadHelper -> C:\Users\Damien\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)
    FF Extension: Firefox Certificate Store Hotfix - C:\Users\Damien\AppData\Roaming\Mozilla\Firefox\Profiles\njojyi70.default-1425130353550\Extensions\firefox-hotfix@mozilla.org.xpi [2015-02-28]
    FF Extension: Adblock Plus - C:\Users\Damien\AppData\Roaming\Mozilla\Firefox\Profiles\njojyi70.default-1425130353550\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-02-28]

    ==================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [79872 2014-01-06] () [File not signed]
    R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2711736 2015-01-13] (Microsoft Corporation)
    R2 CloudBerry Backup Service; C:\Program Files (x86)\CloudBerryLab\CloudBerry Online Backup\CloudBerry.Backup.Scheduler.exe [69928 2015-01-16] (CloudBerry Lab Inc.)
    R2 DACoreService; C:\Program Files (x86)\Nuance\Dragon Assistant\Core\DACore.exe [432528 2013-05-02] (Nuance Communications, Inc.)
    R2 hasplms; C:\Windows\system32\hasplms.exe [4608320 2014-11-26] (SafeNet Inc.)
    R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
    R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
    S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
    R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
    R2 jigezecu; C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\jnsi86BB.tmp [108032 2015-02-27] () [File not signed]
    S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [533760 2014-06-03] (Lenovo)
    R2 Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [584960 2014-05-22] (LENOVO INCORPORATED.)
    R2 LenovoWiFiHotspotSvr; C:\Windows\System32\LenovoWiFiHotspotSvr.exe [198192 2014-08-17] (Lenovo(beijing) Limited)
    R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-12-13] (Nitro PDF Software)
    S3 NorServer.Std; C:\Program Files (x86)\Norsonic\NorXfer\norsrv.exe [1940480 2012-06-19] (Norsonic AS) [File not signed]
    R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
    R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
    R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
    R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
    R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5436176 2015-02-17] (TeamViewer GmbH)
    R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2014-08-17] ()
    R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
    R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
    R2 gibololy; C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727\nsk596B.tmpfs [X]

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    S3 akshasp; C:\Windows\system32\DRIVERS\akshasp.sys [60488 2014-11-26] (SafeNet Inc.)
    S3 akshhl; C:\Windows\system32\DRIVERS\akshhl.sys [63944 2014-11-26] (SafeNet Inc.)
    S3 aksusb; C:\Windows\system32\DRIVERS\aksusb.sys [303624 2014-11-26] (SafeNet Inc.)
    R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
    S3 FastLynx; C:\Program Files (x86)\Norsonic\NorXfer\FastLynx.sys [5036 1999-10-29] () [File not signed]
    R2 hardlock; C:\windows\system32\drivers\hardlock.sys [331608 2014-11-26] (SafeNet Inc.)
    R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
    S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
    R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [558296 2014-01-05] (Realtek Semiconductor Corporation)
    R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [8876248 2013-10-17] (Realtek Semiconductor Corp.)
    R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2982104 2013-12-26] (Realtek Semiconductor Corporation )
    R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-12-24] (Synaptics Incorporated)
    U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-03-03] ()
    R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
    S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-14] ("CyberLink)

    ==================== NetSvcs (Whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2015-03-05 23:02 - 2015-03-05 23:02 - 00001291 _____ () C:\Users\Damien\Desktop\Revo Uninstaller.lnk
    2015-03-05 23:02 - 2015-03-05 23:02 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
    2015-03-05 23:01 - 2015-03-05 23:01 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Damien\Desktop\revosetup.exe
    2015-03-05 22:59 - 2015-03-05 22:59 - 02756424 _____ (Pokki) C:\Users\Damien\Downloads\PokkiInstaller.exe
    2015-03-05 22:59 - 2015-03-05 22:59 - 00822608 _____ (Pokki) C:\Users\Damien\Downloads\Pokki_Start_MenuSetup.exe
    2015-03-05 20:10 - 2015-03-05 20:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
    2015-03-04 10:55 - 2015-03-04 10:55 - 00005552 _____ () C:\windows\system32\PerfStringBackup.TMP
    2015-03-04 07:25 - 2015-03-04 07:25 - 00029166 _____ () C:\Users\Damien\Desktop\Addition.txt
    2015-03-04 07:24 - 2015-03-05 23:16 - 00019531 _____ () C:\Users\Damien\Desktop\FRST.txt
    2015-03-04 07:24 - 2015-03-05 23:16 - 00000000 ____D () C:\FRST
    2015-03-04 07:23 - 2015-03-04 07:23 - 02092544 _____ (Farbar) C:\Users\Damien\Desktop\FRST64.exe
    2015-03-04 07:21 - 2015-03-04 07:21 - 00000615 _____ () C:\Users\Damien\Desktop\JRT.txt
    2015-03-04 07:12 - 2015-03-04 07:12 - 01388333 _____ (Thisisu) C:\Users\Damien\Desktop\JRT(1).exe
    2015-03-04 06:57 - 2015-03-04 06:57 - 00001174 _____ () C:\Users\Damien\Desktop\AdwCleaner[S1].txt
    2015-03-04 06:52 - 2015-03-04 06:42 - 02126848 _____ () C:\Users\Damien\Desktop\adwcleaner_4.111(1).exe
    2015-03-04 06:42 - 2015-03-04 06:42 - 02126848 _____ () C:\Users\Damien\Downloads\adwcleaner_4.111(1).exe
    2015-03-03 16:09 - 2015-03-04 00:47 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\TeamViewer
    2015-03-03 16:09 - 2015-03-03 16:09 - 00001066 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
    2015-03-03 16:09 - 2015-03-03 16:09 - 00001054 _____ () C:\Users\Public\Desktop\TeamViewer 10.lnk
    2015-03-03 16:09 - 2015-03-03 16:09 - 00000000 ____D () C:\Program Files (x86)\TeamViewer
    2015-03-03 16:08 - 2015-03-03 16:08 - 07782048 _____ (TeamViewer GmbH) C:\Users\Damien\Downloads\TeamViewer_Setup_en.exe
    2015-03-03 09:25 - 2015-03-03 09:25 - 00000000 ____D () C:\Users\Damien\AppData\Local\CrashDumps
    2015-03-03 08:16 - 2015-03-03 08:36 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2015-03-03 08:14 - 2015-03-03 08:36 - 00000000 ____D () C:\Users\Damien\Desktop\mbar
    2015-03-03 08:13 - 2015-03-03 08:13 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Damien\Desktop\mbar-1.09.1.1004.exe
    2015-03-03 08:08 - 2015-03-03 08:08 - 00008506 _____ () C:\Users\Damien\Desktop\RKreport_DEL_03032015_080834.log
    2015-03-03 07:52 - 2015-03-03 08:08 - 00000000 ____D () C:\ProgramData\RogueKiller
    2015-03-03 07:52 - 2015-03-03 07:52 - 00035064 _____ () C:\windows\system32\Drivers\TrueSight.sys
    2015-03-03 07:48 - 2015-03-03 07:48 - 15566936 _____ () C:\Users\Damien\Desktop\RogueKiller.exe
    2015-03-02 22:33 - 2015-03-04 00:09 - 00000000 ____D () C:\Users\Damien\Downloads\Game.Of.Thrones.Season.1-4.Complete.720p.x264-ILPruny
    2015-03-02 17:04 - 2015-03-02 17:02 - 00688992 _____ (Swearware) C:\Users\Damien\Desktop\dds.com
    2015-03-02 17:02 - 2015-03-02 17:02 - 00688992 _____ (Swearware) C:\Users\Damien\Downloads\dds.com
    2015-03-02 17:01 - 2015-03-02 17:01 - 00016741 _____ () C:\Users\Damien\Desktop\27_02_15 Scan 1.txt
    2015-03-02 17:01 - 2015-03-02 17:01 - 00001274 _____ () C:\Users\Damien\Desktop\27_02_15 Scan 2.txt
    2015-03-02 17:00 - 2015-03-02 17:00 - 00001184 _____ () C:\Users\Damien\Desktop\02_03_15 Scan.txt
    2015-03-02 16:14 - 2015-03-05 23:14 - 00000273 _____ () C:\Users\Damien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pokki Menu.lnk
    2015-03-02 15:05 - 2015-03-02 15:05 - 01388333 _____ (Thisisu) C:\Users\Damien\Downloads\JRT.exe
    2015-03-02 14:35 - 2015-03-04 06:54 - 00000000 ____D () C:\AdwCleaner
    2015-03-02 14:35 - 2015-03-02 14:35 - 02126848 _____ () C:\Users\Damien\Downloads\adwcleaner_4.111.exe
    2015-03-02 09:02 - 2015-03-02 09:10 - 00000000 ____D () C:\Users\Damien\Downloads\yellow-icon
    2015-03-02 09:02 - 2015-03-02 09:02 - 00100254 _____ () C:\Users\Damien\Downloads\yellow-icon.zip
    2015-02-28 13:32 - 2015-02-28 13:32 - 00000000 ____D () C:\Users\Damien\Desktop\Old Firefox Data
    2015-02-27 20:48 - 2015-02-27 20:48 - 00000000 ____D () C:\Users\Damien\Documents\ProcAlyzer Dumps
    2015-02-27 20:42 - 2015-02-27 20:42 - 00001414 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
    2015-02-27 20:42 - 2015-02-27 20:42 - 00001402 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
    2015-02-27 20:42 - 2015-02-27 20:42 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
    2015-02-27 20:42 - 2015-02-27 20:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
    2015-02-27 20:41 - 2015-02-27 21:06 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
    2015-02-27 20:41 - 2015-02-27 20:44 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
    2015-02-27 20:41 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\windows\system32\sdnclean64.exe
    2015-02-27 20:39 - 2015-02-27 20:41 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Damien\Downloads\spybot-2.4.exe
    2015-02-27 19:36 - 2015-02-27 19:36 - 00628504 _____ (CMI Limited) C:\Users\Damien\AppData\Local\nsuDDF9.tmp
    2015-02-27 19:29 - 2015-02-27 19:29 - 00000000 ____H () C:\windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
    2015-02-27 19:29 - 2015-02-27 19:29 - 00000000 ____D () C:\windows\LastGood.Tmp
    2015-02-27 19:28 - 2015-02-27 19:29 - 00000000 ____D () C:\Users\Damien\.android
    2015-02-27 19:28 - 2015-02-27 19:28 - 00000000 ____D () C:\ProgramData\Samsung
    2015-02-27 19:28 - 2015-02-27 19:28 - 00000000 ____D () C:\Program Files\SAMSUNG
    2015-02-27 19:28 - 2013-05-02 04:23 - 01490656 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01007.dll
    2015-02-27 19:28 - 2013-05-02 04:23 - 00708168 _____ (Microsoft Corporation) C:\windows\system32\WinUSBCoInstaller.dll
    2015-02-27 19:23 - 2015-02-27 19:24 - 00000000 ____D () C:\Program Files (x86)\Kingo ROOT
    2015-02-27 19:23 - 2015-02-27 19:23 - 00001054 _____ () C:\Users\Public\Desktop\Kingo ROOT.lnk
    2015-02-27 19:23 - 2015-02-27 19:23 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Kingosoft
    2015-02-27 19:23 - 2015-02-27 19:23 - 00000000 ____D () C:\Users\Damien\AppData\Local\Kingosoft
    2015-02-27 19:23 - 2015-02-27 19:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kingo ROOT
    2015-02-27 19:18 - 2015-02-27 19:19 - 18645056 _____ (Kingosoft Technology Ltd. ) C:\Users\Damien\Downloads\android_root.exe
    2015-02-27 18:57 - 2015-02-27 18:57 - 00000000 __SHD () C:\Users\Damien\AppData\Local\EmieBrowserModeList
    2015-02-27 18:52 - 2015-03-03 08:16 - 00136408 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
    2015-02-27 18:52 - 2015-03-03 08:14 - 00107736 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
    2015-02-27 18:52 - 2015-02-27 18:52 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2015-02-27 18:52 - 2015-02-27 18:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2015-02-27 18:52 - 2015-02-27 18:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
    2015-02-27 18:52 - 2015-02-27 18:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
    2015-02-27 18:52 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
    2015-02-27 18:52 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
    2015-02-27 18:49 - 2015-02-27 18:50 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Damien\Downloads\mbam-setup-2.0.4.1028.exe
    2015-02-27 18:36 - 2015-02-27 18:36 - 00000000 _____ () C:\autoexec.bat
    2015-02-27 18:33 - 2015-02-27 18:33 - 03109248 _____ (Enigma Software Group USA, LLC.) C:\Users\Damien\Downloads\SpyHunter-Installer.exe
    2015-02-27 18:32 - 2015-02-27 18:33 - 00001681 _____ () C:\windows\SysWOW64\${LOGFILE}
    2015-02-27 18:28 - 2015-02-27 18:33 - 00000000 ____D () C:\Users\Damien\AppData\Local\95A7E375-1425061680-11E4-A818-28D244D31727
    2015-02-27 18:27 - 2015-03-02 16:10 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\95A7E375-1425061631-11E4-A818-28D244D31727
    2015-02-27 18:27 - 2015-02-27 18:27 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Nitro PDF
    2015-02-27 18:25 - 2015-02-27 19:19 - 00000000 ____D () C:\ProgramData\{ce82ef32-0ad0-c1f0-ce82-2ef320adbcc8}
    2015-02-27 18:03 - 2015-02-27 18:16 - 00000000 ____D () C:\Users\Damien\Documents\Galaxy S3 Backup
    2015-02-27 12:37 - 2015-02-27 12:37 - 00000000 ____D () C:\ProgramData\MetaQuotes
    2015-02-27 12:36 - 2015-02-27 12:36 - 04441216 _____ (MetaQuotes Software Corp.) C:\windows\system32\MetaViewer64.dll
    2015-02-27 12:36 - 2015-02-27 12:36 - 00001944 _____ () C:\Users\Public\Desktop\MetaTrader 4.lnk
    2015-02-27 12:36 - 2015-02-27 12:36 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\MetaQuotes
    2015-02-27 12:36 - 2015-02-27 12:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MetaTrader 4
    2015-02-27 12:36 - 2015-02-27 12:36 - 00000000 ____D () C:\Program Files (x86)\MetaTrader 4
    2015-02-27 12:35 - 2015-02-27 12:35 - 00505536 _____ (MetaQuotes Software Corp.) C:\Users\Damien\Downloads\mt4setup(1).exe
    2015-02-26 08:59 - 2015-02-26 08:59 - 00055104 _____ (Microsoft Corporation) C:\windows\system32\Drivers\lpqsidom.sys
    2015-02-25 18:20 - 2015-02-25 19:01 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Skype
    2015-02-25 18:20 - 2015-02-25 18:20 - 00002713 _____ () C:\Users\Public\Desktop\Skype.lnk
    2015-02-25 18:20 - 2015-02-25 18:20 - 00000000 ___RD () C:\Program Files (x86)\Skype
    2015-02-25 18:20 - 2015-02-25 18:20 - 00000000 ____D () C:\Users\Damien\AppData\Local\Skype
    2015-02-25 18:20 - 2015-02-25 18:20 - 00000000 ____D () C:\ProgramData\Skype
    2015-02-25 18:20 - 2015-02-25 18:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
    2015-02-25 18:19 - 2015-02-25 18:19 - 01548384 _____ (Skype Technologies S.A.) C:\Users\Damien\Downloads\SkypeSetup.exe
    2015-02-25 10:27 - 2015-02-25 10:27 - 00053366 _____ () C:\Users\Damien\Downloads\OpaqueTaskbar.zip
    2015-02-25 10:27 - 2015-02-25 10:27 - 00000000 ____D () C:\Users\Damien\Downloads\OpaqueTaskbar
    2015-02-24 13:36 - 2015-02-24 13:36 - 01745757 _____ (Screenomania.com ) C:\Users\Damien\Downloads\cities3d_setup.exe
    2015-02-24 13:35 - 2015-03-04 08:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\3Planesoft
    2015-02-24 13:34 - 2015-02-24 13:35 - 06859856 _____ (3Planesoft ) C:\Users\Damien\Downloads\the_one_ring.exe
    2015-02-24 10:16 - 2015-02-24 10:16 - 02742544 _____ (Lenovo Group Limited ) C:\Users\Damien\Downloads\n15fu03w.exe
    2015-02-24 09:06 - 2015-02-24 09:06 - 00002232 _____ () C:\Users\Public\Desktop\DWG TrueView 2015 - English.lnk
    2015-02-24 09:06 - 2015-02-24 09:06 - 00000000 ____D () C:\Users\Public\Documents\Autodesk
    2015-02-24 09:06 - 2015-02-24 09:06 - 00000000 ____D () C:\Users\Damien\AppData\Local\Autodesk
    2015-02-24 09:06 - 2015-02-24 09:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DWG TrueView 2015 - English
    2015-02-24 09:06 - 2015-02-24 09:06 - 00000000 ____D () C:\Program Files\Common Files\Autodesk Shared
    2015-02-24 09:06 - 2015-02-24 09:06 - 00000000 ____D () C:\Program Files\Autodesk
    2015-02-24 09:05 - 2015-02-24 09:06 - 00000000 ____D () C:\Users\Damien\AppData\Roaming\Autodesk
    2015-02-24 09:05 - 2015-02-24 09:06 - 00000000 ____D () C:\ProgramData\Autodesk
    2015-02-24 09:05 - 2015-02-24 09:05 - 00000674 _____ () C:\windows\DirectX.log
    2015-02-24 09:05 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\windows\SysWOW64\XAudio2_7.dll
    2015-02-24 09:05 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\windows\system32\XAudio2_7.dll
    2015-02-24 09:05 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\windows\SysWOW64\xactengine3_7.dll
    2015-02-24 09:05 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\windows\system32\xactengine3_7.dll
    2015-02-24 09:05 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\windows\system32\XAPOFX1_5.dll
    2015-02-24 09:05 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\windows\SysWOW64\XAPOFX1_5.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\windows\system32\D3DCompiler_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\windows\system32\D3DX9_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DCompiler_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DX9_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\windows\system32\d3dcsx_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dcsx_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\windows\system32\d3dx10_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx10_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\windows\system32\d3dx11_43.dll
    2015-02-24 09:05 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx11_43.dll
    2015-02-24 09:05 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\windows\system32\d3dx9_30.dll
    2015-02-24 09:05 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx9_30.dll
    2015-02-24 09:05 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\windows\system32\xactengine2_1.dll
    2015-02-24 09:05 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\windows\SysWOW64\xactengine2_1.dll
    2015-02-24 09:05 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\windows\system32\xinput1_1.dll
    2015-02-24 09:05 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\windows\SysWOW64\xinput1_1.dll
    2015-02-24 09:05 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\windows\system32\x3daudio1_0.dll
    2015-02-24 09:05 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\windows\SysWOW64\x3daudio1_0.dll
    2015-02-24 09:04 - 2015-02-24 09:04 - 00000000 ____D () C:\Autodesk
    2015-02-24 09:00 - 2015-02-24 09:04 - 342413200 _____ () C:\Users\Damien\Downloads\SetupDWGTrueView2015_ENU_64bit.sfx.exe
    2015-02-23 23:27 - 2015-02-23 23:31 - 00000000 ____D () C:\Users\Damien\Downloads\The Grand Budapest Hotel (2014)
    2015-02-23 11:48 - 2015-02-23 11:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
    2015-02-23 11:48 - 2015-02-23 11:48 - 00000000 ____D () C:\Program Files\Common Files\EPSON
    2015-02-23 11:47 - 2015-02-24 13:33 - 00000000 ____D () C:\ProgramData\EPSON
    2015-02-23 11:46 - 2015-01-07 00:05 - 00120320 _____ (SEIKO EPSON CORPORATION) C:\windows\system32\E_YLMIXE.DLL
    2015-02-23 11:46 - 2015-01-07 00:05 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\windows\system32\E_YD4BIXE.DLL
    2015-02-23 11:46 - 2015-01-07 00:05 - 00010752 _____ (SEIKO EPSON CORP.) C:\windows\system32\E_GCINST.DLL
    2015-02-21 10:34 - 2015-02-21 10:34 - 00002782 _____ () C:\Users\Damien\Downloads\07391770.csv
    2015-02-18 11:18 - 2015-02-18 11:18 - 00000000 ____H () C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
    2015-02-18 10:07 - 2015-02-18 10:07 - 00000090 _____ () C:\Users\Damien\Downloads\rootkey.csv
    2015-02-18 09:44 - 2015-02-18 09:44 - 00002330 _____ () C:\Users\Public\Desktop\CloudBerry Online Backup.lnk
    2015-02-18 09:44 - 2015-02-18 09:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CloudBerryLab
    2015-02-18 09:44 - 2015-02-18 09:44 - 00000000 ____D () C:\Program Files (x86)\CloudBerryLab
    2015-02-18 09:25 - 2015-02-18 09:26 - 24215496 _____ () C:\Users\Damien\Downloads\CloudBerryOnlineBackupSetup_v4.0.1.73S3netv4.0.exe
    2015-02-17 17:30 - 2015-02-17 17:30 - 14459960 _____ () C:\Users\Damien\Downloads\TerraAltoLimitedS3OnlineBackupwithTerraAlto_v3.9.2.52_netv4.0_Desktop_Setup_20140702221708.exe
    2015-02-17 16:39 - 2015-02-17 16:39 - 00000462 _____ () C:\Users\Damien\Downloads\Elements (Z).lnk
    2015-02-17 13:08 - 2015-02-17 13:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
    2015-02-17 12:54 - 2014-07-24 15:28 - 00419648 ____C (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
    2015-02-17 12:54 - 2014-07-24 15:28 - 00412992 ____C (Microsoft Corporation) C:\windows\system32\Drivers\spaceport.sys
    2015-02-17 12:54 - 2014-07-24 15:28 - 00280384 ____C (Microsoft Corporation) C:\windows\system32\Drivers\pci.sys
    2015-02-17 12:54 - 2014-07-24 15:28 - 00143680 ____C (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
    2015-02-17 12:54 - 2014-07-24 15:25 - 00054752 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
    2015-02-17 12:54 - 2014-07-24 15:23 - 00125472 _____ (Microsoft Corporation) C:\windows\system32\dwmapi.dll
    2015-02-17 12:54 - 2014-07-24 15:20 - 00645592 _____ (Microsoft Corporation) C:\windows\system32\SHCore.dll
    2015-02-17 12:54 - 2014-07-24 15:20 - 00263400 _____ (Microsoft Corporation) C:\windows\system32\SystemSettingsAdminFlows.exe
    2015-02-17 12:54 - 2014-07-24 15:16 - 02574208 _____ (Microsoft Corporation)
     
  25. rtcwlomax

    rtcwlomax TS Rookie Topic Starter Posts: 65

    C:\windows\system32\WMVDECOD.DLL
    2015-02-17 12:54 - 2014-07-24 15:16 - 00211216 _____ (Microsoft Corporation) C:\windows\system32\SndVol.exe
    2015-02-17 12:54 - 2014-07-24 15:07 - 02009920 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ntfs.sys
    2015-02-17 12:54 - 2014-07-24 15:05 - 01660048 _____ (Microsoft Corporation) C:\windows\system32\winload.efi
    2015-02-17 12:54 - 2014-07-24 15:05 - 01519560 _____ (Microsoft Corporation) C:\windows\system32\winload.exe
    2015-02-17 12:54 - 2014-07-24 15:05 - 01488008 _____ (Microsoft Corporation) C:\windows\system32\winresume.efi
    2015-02-17 12:54 - 2014-07-24 15:05 - 01356840 _____ (Microsoft Corporation) C:\windows\system32\winresume.exe
    2015-02-17 12:54 - 2014-07-24 15:03 - 02141920 _____ (Microsoft Corporation) C:\windows\system32\mfcore.dll
    2015-02-17 12:54 - 2014-07-24 15:03 - 00882136 _____ (Microsoft Corporation) C:\windows\system32\mfplat.dll
    2015-02-17 12:54 - 2014-07-24 15:03 - 00360480 _____ (Microsoft Corporation) C:\windows\system32\mfreadwrite.dll
    2015-02-17 12:54 - 2014-07-24 15:03 - 00233888 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
    2015-02-17 12:54 - 2014-07-24 15:03 - 00205512 _____ (Microsoft Corporation) C:\windows\system32\mftranscode.dll
    2015-02-17 12:54 - 2014-07-24 13:50 - 00098048 _____ (Microsoft Corporation) C:\windows\SysWOW64\dwmapi.dll
    2015-02-17 12:54 - 2014-07-24 13:48 - 02410976 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
    2015-02-17 12:54 - 2014-07-24 13:48 - 00180208 _____ (Microsoft Corporation) C:\windows\SysWOW64\SndVol.exe
    2015-02-17 12:54 - 2014-07-24 13:46 - 00477200 _____ (Microsoft Corporation) C:\windows\SysWOW64\SHCore.dll
    2015-02-17 12:54 - 2014-07-24 13:36 - 02145472 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfcore.dll
    2015-02-17 12:54 - 2014-07-24 13:36 - 00707536 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfplat.dll
    2015-02-17 12:54 - 2014-07-24 13:36 - 00355800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfreadwrite.dll
    2015-02-17 12:54 - 2014-07-24 13:36 - 00180720 _____ (Microsoft Corporation) C:\windows\SysWOW64\mftranscode.dll
    2015-02-17 12:54 - 2014-07-24 11:51 - 00008192 _____ (Microsoft Corporation) C:\windows\system32\KBDRUM.DLL
    2015-02-17 12:54 - 2014-07-24 11:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDYAK.DLL
    2015-02-17 12:54 - 2014-07-24 11:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDTT102.DLL
    2015-02-17 12:54 - 2014-07-24 11:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDTAT.DLL
    2015-02-17 12:54 - 2014-07-24 11:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDRU1.DLL
    2015-02-17 12:54 - 2014-07-24 11:51 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDBASH.DLL
    2015-02-17 12:54 - 2014-07-24 11:51 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\KBDRU.DLL
    2015-02-17 12:54 - 2014-07-24 11:46 - 00079872 _____ (Microsoft Corporation) C:\windows\system32\Drivers\IPMIDrv.sys
    2015-02-17 12:54 - 2014-07-24 11:45 - 00076800 ____C (Microsoft Corporation) C:\windows\system32\Drivers\hdaudbus.sys
    2015-02-17 12:54 - 2014-07-24 11:44 - 00674816 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv2.sys
    2015-02-17 12:54 - 2014-07-24 11:43 - 00412160 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv.sys
    2015-02-17 12:54 - 2014-07-24 11:42 - 00446976 _____ (Microsoft Corporation) C:\windows\system32\Drivers\nwifi.sys
    2015-02-17 12:54 - 2014-07-24 11:42 - 00126464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\NdisImPlatform.sys
    2015-02-17 12:54 - 2014-07-24 11:41 - 00118272 ____C (Microsoft Corporation) C:\windows\system32\Drivers\bthpan.sys
    2015-02-17 12:54 - 2014-07-24 11:33 - 00059392 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
    2015-02-17 12:54 - 2014-07-24 11:33 - 00050688 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
    2015-02-17 12:54 - 2014-07-24 11:06 - 00220160 _____ (Microsoft Corporation) C:\windows\system32\iasnap.dll
    2015-02-17 12:54 - 2014-07-24 11:05 - 00287232 _____ (Microsoft Corporation) C:\windows\system32\usbmon.dll
    2015-02-17 12:54 - 2014-07-24 11:05 - 00226816 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll
    2015-02-17 12:54 - 2014-07-24 10:52 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDYAK.DLL
    2015-02-17 12:54 - 2014-07-24 10:52 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDTT102.DLL
    2015-02-17 12:54 - 2014-07-24 10:52 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDTAT.DLL
    2015-02-17 12:54 - 2014-07-24 10:51 - 00008192 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRUM.DLL
    2015-02-17 12:54 - 2014-07-24 10:51 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRU1.DLL
    2015-02-17 12:54 - 2014-07-24 10:51 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDBASH.DLL
    2015-02-17 12:54 - 2014-07-24 10:51 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRU.DLL
    2015-02-17 12:54 - 2014-07-24 10:49 - 00065536 _____ (Microsoft Corporation) C:\windows\system32\WorkFoldersGPExt.dll
    2015-02-17 12:54 - 2014-07-24 10:33 - 00026112 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
    2015-02-17 12:54 - 2014-07-24 10:32 - 00207360 _____ (Microsoft Corporation) C:\windows\system32\powercfg.cpl
    2015-02-17 12:54 - 2014-07-24 10:20 - 02050560 _____ (Microsoft Corporation) C:\windows\system32\SRH.dll
    2015-02-17 12:54 - 2014-07-24 10:18 - 01089024 _____ (Microsoft Corporation) C:\windows\system32\gpedit.dll
    2015-02-17 12:54 - 2014-07-24 10:12 - 00878592 _____ (Microsoft Corporation) C:\windows\system32\ActionCenter.dll
    2015-02-17 12:54 - 2014-07-24 10:10 - 01844224 _____ (Microsoft Corporation) C:\windows\system32\Display.dll
    2015-02-17 12:54 - 2014-07-24 10:10 - 00834560 _____ (Microsoft Corporation) C:\windows\system32\osk.exe
    2015-02-17 12:54 - 2014-07-24 10:10 - 00198656 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll
    2015-02-17 12:54 - 2014-07-24 10:10 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\iasnap.dll
    2015-02-17 12:54 - 2014-07-24 10:05 - 00187392 _____ (Microsoft Corporation) C:\windows\system32\WorkFoldersShell.dll
    2015-02-17 12:54 - 2014-07-24 09:52 - 00621056 _____ (Microsoft Corporation) C:\windows\system32\comdlg32.dll
    2015-02-17 12:54 - 2014-07-24 09:44 - 16874496 _____ (Microsoft Corporation) C:\windows\system32\Windows.UI.Xaml.dll
    2015-02-17 12:54 - 2014-07-24 09:42 - 00206336 _____ (Microsoft Corporation) C:\windows\SysWOW64\powercfg.cpl
    2015-02-17 12:54 - 2014-07-24 09:40 - 00557056 _____ (Microsoft Corporation) C:\windows\system32\PrintDialogs.dll
    2015-02-17 12:54 - 2014-07-24 09:39 - 00770048 _____ (Microsoft Corporation) C:\windows\system32\WorkfoldersControl.dll
    2015-02-17 12:54 - 2014-07-24 09:33 - 01741824 _____ (Microsoft Corporation) C:\windows\SysWOW64\SRH.dll
    2015-02-17 12:54 - 2014-07-24 09:32 - 01048064 _____ (Microsoft Corporation) C:\windows\SysWOW64\gpedit.dll
    2015-02-17 12:54 - 2014-07-24 09:27 - 00779264 _____ (Microsoft Corporation) C:\windows\SysWOW64\osk.exe
    2015-02-17 12:54 - 2014-07-24 09:25 - 00832512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ActionCenter.dll
    2015-02-17 12:54 - 2014-07-24 09:24 - 01817088 _____ (Microsoft Corporation) C:\windows\SysWOW64\Display.dll
    2015-02-17 12:54 - 2014-07-24 09:21 - 00134144 _____ (Microsoft Corporation) C:\windows\system32\browser.dll
    2015-02-17 12:54 - 2014-07-24 09:18 - 00018432 _____ (Microsoft Corporation) C:\windows\system32\wlansvcpal.dll
    2015-02-17 12:54 - 2014-07-24 09:16 - 12730880 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.UI.Xaml.dll
    2015-02-17 12:54 - 2014-07-24 09:14 - 00443904 _____ (Microsoft Corporation) C:\windows\system32\wlansec.dll
    2015-02-17 12:54 - 2014-07-24 09:12 - 00127488 _____ (Microsoft Corporation) C:\windows\system32\WiFiDisplay.dll
    2015-02-17 12:54 - 2014-07-24 09:11 - 00356864 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
    2015-02-17 12:54 - 2014-07-24 09:11 - 00063488 _____ (Microsoft Corporation) C:\windows\system32\wshbth.dll
    2015-02-17 12:54 - 2014-07-24 09:10 - 00540672 _____ (Microsoft Corporation) C:\windows\SysWOW64\comdlg32.dll
    2015-02-17 12:54 - 2014-07-24 09:04 - 00492032 _____ (Microsoft Corporation) C:\windows\SysWOW64\PrintDialogs.dll
    2015-02-17 12:54 - 2014-07-24 09:04 - 00183808 _____ (Microsoft Corp.) C:\windows\system32\Defrag.exe
    2015-02-17 12:54 - 2014-07-24 09:03 - 00324096 _____ (Microsoft Corporation) C:\windows\system32\srvsvc.dll
    2015-02-17 12:54 - 2014-07-24 08:58 - 00105472 _____ (Microsoft Corporation) C:\windows\system32\BluetoothApis.dll
    2015-02-17 12:54 - 2014-07-24 08:53 - 01261056 _____ (Microsoft Corporation) C:\windows\system32\gpsvc.dll
    2015-02-17 12:54 - 2014-07-24 08:53 - 00449536 _____ (Microsoft Corporation) C:\windows\system32\defragsvc.dll
    2015-02-17 12:54 - 2014-07-24 08:49 - 01287680 _____ (Microsoft Corporation) C:\windows\system32\mispace.dll
    2015-02-17 12:54 - 2014-07-24 08:49 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\wlanapi.dll
    2015-02-17 12:54 - 2014-07-24 08:48 - 00659968 _____ (Microsoft Corporation) C:\windows\system32\Windows.Devices.Bluetooth.dll
    2015-02-17 12:54 - 2014-07-24 08:47 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\wcmcsp.dll
    2015-02-17 12:54 - 2014-07-24 08:43 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wshbth.dll
    2015-02-17 12:54 - 2014-07-24 08:39 - 02397184 _____ (Microsoft Corporation) C:\windows\system32\storagewmi.dll
    2015-02-17 12:54 - 2014-07-24 08:38 - 00371200 _____ (Microsoft Corporation) C:\windows\system32\wlanmsm.dll
    2015-02-17 12:54 - 2014-07-24 08:36 - 00079872 _____ (Microsoft Corporation) C:\windows\SysWOW64\BluetoothApis.dll
    2015-02-17 12:54 - 2014-07-24 08:32 - 01532416 _____ (Microsoft Corporation) C:\windows\system32\wlansvc.dll
    2015-02-17 12:54 - 2014-07-24 08:30 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\wlanapi.dll
    2015-02-17 12:54 - 2014-07-24 08:29 - 00439296 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.Devices.Bluetooth.dll
    2015-02-17 12:54 - 2014-07-24 08:28 - 00595456 _____ (Microsoft Corporation) C:\windows\system32\Windows.Networking.dll
    2015-02-17 12:54 - 2014-07-24 08:23 - 01404416 _____ (Microsoft Corporation) C:\windows\SysWOW64\storagewmi.dll
    2015-02-17 12:54 - 2014-07-24 08:22 - 00487936 _____ (Microsoft Corporation) C:\windows\system32\winspool.drv
    2015-02-17 12:54 - 2014-07-24 08:21 - 01231872 _____ (Microsoft Corporation) C:\windows\system32\Windows.Media.dll
    2015-02-17 12:54 - 2014-07-24 08:21 - 00302080 _____ (Microsoft Corporation) C:\windows\SysWOW64\wlanmsm.dll
    2015-02-17 12:54 - 2014-07-24 08:19 - 00388608 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
    2015-02-17 12:54 - 2014-07-24 08:18 - 01144320 _____ (Microsoft Corporation) C:\windows\system32\wwanmm.dll
    2015-02-17 12:54 - 2014-07-24 08:18 - 00795136 _____ (Microsoft Corporation) C:\windows\system32\spoolsv.exe
    2015-02-17 12:54 - 2014-07-24 08:18 - 00093696 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
    2015-02-17 12:54 - 2014-07-24 08:16 - 00505344 _____ (Microsoft Corporation) C:\windows\system32\VAN.dll
    2015-02-17 12:54 - 2014-07-24 08:16 - 00084480 _____ (Microsoft Corporation) C:\windows\system32\wpdbusenum.dll
    2015-02-17 12:54 - 2014-07-24 08:15 - 00828416 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
    2015-02-17 12:54 - 2014-07-24 08:15 - 00721408 _____ (Microsoft Corporation) C:\windows\system32\twinapi.dll
    2015-02-17 12:54 - 2014-07-24 08:15 - 00432128 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.Networking.dll
    2015-02-17 12:54 - 2014-07-24 08:13 - 00226304 _____ (Microsoft Corporation) C:\windows\system32\SndVolSSO.dll
    2015-02-17 12:54 - 2014-07-24 08:10 - 00889344 _____ (Microsoft Corporation) C:\windows\SysWOW64\Windows.Media.dll
    2015-02-17 12:54 - 2014-07-24 08:10 - 00371712 _____ (Microsoft Corporation) C:\windows\SysWOW64\winspool.drv
    2015-02-17 12:54 - 2014-07-24 08:08 - 00321536 _____ (Microsoft Corporation) C:\windows\system32\stobject.dll
    2015-02-17 12:54 - 2014-07-24 08:07 - 01705472 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
    2015-02-17 12:54 - 2014-07-24 08:06 - 00080896 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
    2015-02-17 12:54 - 2014-07-24 08:05 - 00448000 _____ (Microsoft Corporation) C:\windows\SysWOW64\VAN.dll
    2015-02-17 12:54 - 2014-07-24 08:04 - 00667136 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
    2015-02-17 12:54 - 2014-07-24 08:02 - 03465216 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
    2015-02-17 12:54 - 2014-07-24 08:01 - 01992192 _____ (Microsoft Corporation) C:\windows\system32\XpsPrint.dll
    2015-02-17 12:54 - 2014-07-24 08:00 - 02100736 _____ (Microsoft Corporation) C:\windows\system32\SystemSettingsAdminFlowUI.dll
    2015-02-17 12:54 - 2014-07-24 07:58 - 00432640 _____ (Microsoft Corporation) C:\windows\system32\wwanconn.dll
    2015-02-17 12:54 - 2014-07-24 07:58 - 00288768 _____ (Microsoft Corporation) C:\windows\SysWOW64\stobject.dll
    2015-02-17 12:54 - 2014-07-24 07:54 - 01290752 _____ (Microsoft Corporation) C:\windows\SysWOW64\XpsPrint.dll
    2015-02-17 12:54 - 2014-07-24 07:50 - 01182208 _____ (Microsoft Corporation) C:\windows\system32\printui.dll
    2015-02-17 12:54 - 2014-07-24 07:47 - 00576512 _____ (Microsoft Corporation) C:\windows\system32\SettingSync.dll
    2015-02-17 12:54 - 2014-07-24 07:44 - 01057792 _____ (Microsoft Corporation) C:\windows\SysWOW64\printui.dll
    2015-02-17 12:54 - 2014-07-24 07:41 - 00459264 _____ (Microsoft Corporation) C:\windows\SysWOW64\SettingSync.dll
    2015-02-17 12:54 - 2014-07-24 07:28 - 01600000 _____ (Microsoft Corporation) C:\windows\system32\workfolderssvc.dll
    2015-02-17 12:54 - 2014-07-24 04:11 - 00513544 _____ () C:\windows\SysWOW64\locale.nls
    2015-02-17 12:54 - 2014-07-24 04:11 - 00513544 _____ () C:\windows\system32\locale.nls
    2015-02-17 12:54 - 2014-07-12 05:55 - 00268288 _____ (Microsoft Corporation) C:\windows\system32\wisp.dll
    2015-02-17 12:54 - 2014-07-12 04:58 - 00210944 _____ (Microsoft Corporation) C:\windows\SysWOW64\wisp.dll
    2015-02-17 12:54 - 2014-07-04 12:59 - 00295424 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ks.sys
    2015-02-17 12:54 - 2014-07-04 10:29 - 00117248 _____ (Microsoft Corporation) C:\windows\system32\AppxSip.dll
    2015-02-17 12:54 - 2014-07-04 10:20 - 01656832 _____ (Microsoft Corporation) C:\windows\system32\GdiPlus.dll
    2015-02-17 12:54 - 2014-07-04 10:06 - 00095232 _____ (Microsoft Corporation) C:\windows\SysWOW64\AppxSip.dll
    2015-02-17 12:54 - 2014-07-04 10:00 - 01351168 _____ (Microsoft Corporation) C:\windows\SysWOW64\GdiPlus.dll
    2015-02-17 12:54 - 2014-07-04 09:30 - 00544768 _____ (Microsoft Corporation) C:\windows\system32\AppxPackaging.dll
    2015-02-17 12:54 - 2014-07-04 09:27 - 00474112 _____ (Microsoft Corporation) C:\windows\SysWOW64\AppxPackaging.dll
    2015-02-17 12:54 - 2014-06-27 06:22 - 00246272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srvnet.sys
    2015-02-17 12:54 - 2014-06-26 00:32 - 01029632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mispace.dll
    2015-02-17 12:54 - 2014-06-26 00:29 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\dab.dll
    2015-02-17 12:54 - 2014-06-19 23:37 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
    2015-02-17 12:54 - 2014-06-19 02:13 - 00310080 ____C (Microsoft Corporation) C:\windows\system32\Drivers\volsnap.sys
    2015-02-17 12:54 - 2014-06-14 06:03 - 02389504 _____ (Microsoft Corporation) C:\windows\system32\d3d10warp.dll
    2015-02-17 12:54 - 2014-06-14 05:46 - 02071552 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d10warp.dll
    2015-02-17 12:54 - 2014-06-07 12:46 - 00216368 _____ (Microsoft Corporation) C:\windows\system32\rsaenh.dll
    2015-02-17 12:54 - 2014-06-07 10:20 - 00189016 _____ (Microsoft Corporation) C:\windows\SysWOW64\rsaenh.dll
    2015-02-17 12:54 - 2014-06-05 14:00 - 01118040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ndis.sys
    2015-02-17 12:54 - 2014-06-05 10:18 - 01018368 _____ (Microsoft Corporation) C:\windows\system32\aclui.dll
    2015-02-17 12:54 - 2014-06-05 09:42 - 00889856 _____ (Microsoft Corporation) C:\windows\SysWOW64\aclui.dll
    2015-02-17 12:54 - 2014-05-31 05:00 - 01463808 _____ (Microsoft Corporation) C:\windows\system32\wsecedit.dll
    2015-02-17 12:54 - 2014-05-31 04:18 - 01319936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wsecedit.dll
    2015-02-17 12:54 - 2014-05-29 06:23 - 00427008 _____ (Microsoft Corporation) C:\windows\system32\clusapi.dll
    2015-02-17 12:54 - 2014-05-29 05:25 - 00313856 _____ (Microsoft Corporation) C:\windows\SysWOW64\clusapi.dll
    2015-02-17 12:54 - 2014-05-26 07:26 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\AppxSysprep.dll
    2015-02-17 12:54 - 2014-05-10 10:12 - 00387896 _____ (Microsoft Corporation) C:\windows\system32\bcryptprimitives.dll
    2015-02-17 12:54 - 2014-05-10 08:46 - 00335680 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcryptprimitives.dll
    2015-02-17 12:54 - 2014-05-06 04:41 - 00486744 _____ (Microsoft Corporation) C:\windows\system32\netcfgx.dll
    2015-02-17 12:54 - 2014-05-06 00:55 - 00391000 _____ (Microsoft Corporation) C:\windows\SysWOW64\netcfgx.dll
    2015-02-17 12:54 - 2014-03-25 02:27 - 00160600 _____ (Microsoft Corporation) C:\windows\system32\winmmbase.dll
    2015-02-17 12:54 - 2014-03-25 02:27 - 00123920 _____ (Microsoft Corporation) C:\windows\system32\winmm.dll
    2015-02-17 12:54 - 2014-03-25 01:20 - 00128568 _____ (Microsoft Corporation) C:\windows\SysWOW64\winmm.dll
    2015-02-17 12:54 - 2014-03-25 01:20 - 00127544 _____ (Microsoft Corporation) C:\windows\SysWOW64\winmmbase.dll
    2015-02-17 12:52 - 2015-02-17 13:02 - 00083330 _____ () C:\Users\Damien\Desktop\AA Job Booking Form R1.xlsm
    2015-02-17 12:46 - 2015-01-23 04:41 - 06041600 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
    2015-02-17 12:46 - 2015-01-23 03:17 - 04300800 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
    2015-02-17 12:25 - 2015-02-03 19:31 - 00714720 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
    2015-02-17 12:25 - 2015-02-03 19:31 - 00106976 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
    2015-02-17 12:21 - 2015-02-17 12:21 - 00000000 ___SD () C:\windows\system32\CompatTel
    2015-02-17 12:21 - 2015-02-17 12:21 - 00000000 ____D () C:\windows\system32\appraiser
    2015-02-17 02:41 - 2015-02-17 02:44 - 00000000 ____D () C:\windows\system32\MRT
    2015-02-17 02:41 - 2015-01-29 17:49 - 116773704 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
    2015-02-17 02:40 - 2014-04-14 03:29 - 01018880 _____ (Microsoft Corporation) C:\windows\system32\termsrv.dll
    2015-02-17 00:22 - 2015-02-19 19:22 - 00000000 ___RD () C:\Users\Damien\Dropbox
    2015-02-17 00:22 - 2015-02-17 00:22 - 00001151 _____ () C:\Users\Damien\Desktop\Dropbox.lnk
    2015-02-17 00:18 - 2015-02-17 00:18 - 00000000 ____D () C:\Users\Damien_2\AppData\Roaming\Mozilla
    2015-02-17 00:18 - 2015-02-17 00:18 - 00000000 ____D () C:\Users\Damien_2\AppData\Local\Mozilla
    2015-02-17 00:17 - 2015-02-17 00:17 - 00003596 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1301979038-2669888510-292050220-1003
    2015-02-17 00:13 - 2015-02-17 00:13 - 00000000 ____D () C:\Users\Damien_2\AppData\Roaming\Intel Corporation
    2015-02-17 00:12 - 2015-02-17 00:20 - 00002260 _____ () C:\Users\Damien_2\AppData\Local\BTServer.log
    2015-02-17 00:12 - 2015-02-17 00:13 - 00000000 ____D () C:\Users\Damien_2\AppData\Local\Packages
    2015-02-17 00:12 - 2015-02-17 00:12 - 00001453 _____ () C:\Users\Damien_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
    2015-02-17 00:12 - 2015-02-17 00:12 - 00001260 _____ () C:\Users\Damien_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BTServer Toasts App.lnk
    2015-02-17 00:12 - 2015-02-17 00:12 - 00000020 ___SH () C:\Users\Damien_2\ntuser.ini
    2015-02-17 00:12 - 2015-02-17 00:12 - 00000000 ____D () C:\Users\Damien_2\Documents\My Bluetooth
    2015-02-17 00:12 - 2015-02-17 00:12 - 00000000 ____D () C:\Users\Damien_2\AppData\Roaming\My Bluetooth
    2015-02-17 00:12 - 2015-02-17 00:12 - 00000000 ____D () C:\Users\Damien_2\AppData\Roaming\Hightail for Lenovo
    2015-02-17 00:12 - 2015-02-17 00:12 - 00000000 ____D () C:\Users\Damien_2\AppData\Roaming\Adobe
    2015-02-17 00:12 - 2015-02-17 00:12 - 00000000 ____D () C:\Users\Damien_2\AppData\Local\VirtualStore
    2015-02-17 00:11 - 2015-02-17 00:13 - 00000000 ____D () C:\Users\Damien_2\AppData\Local\Pokki
    2015-02-17 00:11 - 2015-02-17 00:12 - 00000000 ____D () C:\Users\Damien_2
    2015-02-17 00:11 - 2014-08-17 16:06 - 00000126 _____ () C:\Users\Damien_2\Desktop\Adobe Photo Offer.url
    2015-02-17 00:11 - 2014-08-17 15:18 - 00000000 ___RD () C:\Users\Damien_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
    2015-02-17 00:11 - 2014-03-26 10:21 - 00000190 _____ () C:\Users\Damien_2\Desktop\FREE CALLS with Voxox.url
    2015-02-17 00:11 - 2014-03-18 10:05 - 00000000 ___RD () C:\Users\Damien_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
    2015-02-17 00:11 - 2014-03-18 09:55 - 00000369 _____ () C:\Users\Damien_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
    2015-02-17 00:11 - 2014-03-18 09:55 - 00000369 _____ () C:\Users\Damien_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
    2015-02-17 00:11 - 2013-08-22 15:36 - 00000000 ___RD () C:\Users\Damien_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
    2015-02-17 00:11 - 2013-08-22 15:36 - 00000000 ____D () C:\Users\Damien_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
    2015-02-16 18:24 - 2015-02-16 18:24 - 00002093 _____ () C:\Users\Damien\Desktop\Insul 8.0.lnk
    2015-02-16 17:22 - 2014-11-10 02:29 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\DeviceSetupStatusProvider.dll
    2015-02-16 17:22 - 2014-11-10 01:51 - 00028672 _____ (Microsoft Corporation) C:\windows\SysWOW64\DeviceSetupStatusProvider.dll
    2015-02-16 17:22 - 2014-08-15 00:36 - 00146752 _____ (Microsoft Corporation) C:\windows\system32\Drivers\msgpioclx.sys
    2015-02-16 17:22 - 2014-07-30 01:56 - 00299520 _____ (Microsoft Corporation) C:\windows\system32\WSDMon.dll
    2015-02-16 17:22 - 2014-07-29 05:22 - 00205824 _____ (Microsoft Corporation) C:\windows\system32\tcpmon.dll
    2015-02-16 17:22 - 2014-05-30 03:03 - 00563200 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys
    2015-02-16 17:21 - 2014-10-30 23:39 - 01970432 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
    2015-02-16 17:21 - 2014-10-30 23:38 - 01612992 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
    2015-02-16 17:15 - 2015-01-15 22:43 - 00563504 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
    2015-02-16 17:15 - 2015-01-15 22:43 - 00177984 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
    2015-02-16 17:15 - 2015-01-14 04:22 - 00445440 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
    2015-02-16 17:15 - 2015-01-14 03:53 - 00324096 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
    2015-02-16 17:15 - 2014-12-19 08:57 - 00788680 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
    2015-02-16 17:15 - 2014-12-19 08:25 - 00602776 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
    2015-02-16 17:15 - 2014-12-09 01:50 - 00225280 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
    2015-02-16 17:15 - 2014-10-29 02:51 - 00154112 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
    2015-02-16 17:15 - 2014-10-29 02:50 - 00736768 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
    2015-02-16 17:15 - 2014-10-29 02:06 - 00736768 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
    2015-02-16 17:15 - 2014-10-29 02:06 - 00154112 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
    2015-02-16 17:15 - 2014-10-29 01:31 - 01441792 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
    2015-02-16 17:15 - 2014-10-13 02:33 - 00116032 _____ (Microsoft Corporation) C:\windows\system32\consent.exe
    2015-02-16 17:15 - 2014-10-11 00:58 - 03320320 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
    2015-02-16 17:15 - 2014-10-11 00:53 - 03607040 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
    2015-02-16 17:15 - 2014-10-08 07:30 - 00110080 _____ (Microsoft Corporation) C:\windows\system32\appinfo.dll
    2015-02-16 17:15 - 2014-10-08 07:09 - 00428032 _____ (Microsoft Corporation) C:\windows\system32\msihnd.dll
    2015-02-16 17:15 - 2014-10-08 06:27 - 00325120 _____ (Microsoft Corporation) C:\windows\SysWOW64\msihnd.dll
    2015-02-16 17:15 - 2014-10-08 05:32 - 02773504 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
    2015-02-16 17:15 - 2014-10-08 05:19 - 02459136 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
    2015-02-16 17:15 - 2014-09-22 04:38 - 01519488 _____ (Microsoft Corporation) C:\windows\system32\user32.dll
    2015-02-16 17:15 - 2014-09-22 03:06 - 00258368 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WdFilter.sys
    2015-02-16 17:15 - 2014-09-22 03:06 - 00114496 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WdNisDrv.sys
    2015-02-16 17:15 - 2014-09-22 02:49 - 00035320 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WdBoot.sys
    2015-02-16 17:15 - 2014-09-19 00:16 - 01346048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user32.dll
    2015-02-16 17:15 - 2014-09-02 22:08 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\winshfhc.dll
    2015-02-16 17:15 - 2014-09-02 22:08 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\winshfhc.dll
    2015-02-16 17:13 - 2015-01-13 22:11 - 01762840 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
    2015-02-16 17:13 - 2015-01-13 22:04 - 01489072 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
    2015-02-16 17:13 - 2014-12-09 03:45 - 00393728 _____ (Microsoft Corporation) C:\windows\SysWOW64\scesrv.dll
    2015-02-16 17:13 - 2014-12-09 01:56 - 00538624 _____ (Microsoft Corporation) C:\windows\system32\scesrv.dll
    2015-02-16 17:13 - 2014-09-27 07:13 - 00104336 _____ (Microsoft Corporation) C:\windows\system32\ncryptsslp.dll
    2015-02-16 17:13 - 2014-09-27 05:24 - 00088800 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncryptsslp.dll
    2015-02-16 17:13 - 2014-09-27 03:30 - 00185856 _____ (Microsoft Corporation) C:\windows\system32\dpapisrv.dll
    2015-02-16 17:13 - 2014-06-20 01:48 - 01273184 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
    2015-02-16 17:13 - 2014-06-19 23:52 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
    2015-02-16 17:08 - 2014-10-10 01:58 - 00027456 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rdpvideominiport.sys
    2015-02-16 17:08 - 2014-10-08 07:34 - 00131584 _____ (Microsoft Corporation) C:\windows\system32\rdpudd.dll
    2015-02-16 17:08 - 2014-10-08 07:24 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\rfxvmt.dll
    2015-02-16 17:08 - 2014-10-08 05:23 - 03547648 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
    2015-02-16 17:07 - 2014-06-13 01:15 - 00517528 _____ (Microsoft Corporation) C:\windows\system32\dxgi.dll
    2015-02-16 17:07 - 2014-06-13 01:14 - 01557848 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
    2015-02-16 17:07 - 2014-06-13 00:10 - 00406400 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxgi.dll
    2015-02-16 17:07 - 2014-06-06 11:34 - 02133504 _____ (Microsoft Corporation) C:\windows\system32\dwmcore.dll
    2015-02-16 17:06 - 2014-12-08 23:12 - 00391526 _____ () C:\windows\system32\ApnDatabase.xml
    2015-02-16 17:06 - 2014-08-07 02:12 - 01336624 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
    2015-02-16 17:06 - 2014-08-02 03:56 - 01064448 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
    2015-02-16 17:04 - 2014-08-23 05:18 - 02149376 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
    2015-02-16 17:04 - 2014-08-23 05:03 - 01346048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll
    2015-02-16 17:04 - 2014-06-09 22:13 - 00035480 _____ (Microsoft Corporation) C:\windows\SysWOW64\TsWpfWrp.exe
    2015-02-16 17:04 - 2014-06-09 22:13 - 00035480 _____ (Microsoft Corporation) C:\windows\system32\TsWpfWrp.exe
    2015-02-16 17:03 - 2014-05-19 06:31 - 00057856 _____ (Microsoft Corporation) C:\windows\system32\drvcfg.exe
    2015-02-16 17:03 - 2014-05-19 06:21 - 00110592 _____ (Microsoft Corporation) C:\windows\system32\drvinst.exe
    2015-02-16 17:03 - 2014-05-19 05:23 - 00098816 _____ (Microsoft Corporation) C:\windows\SysWOW64\drvinst.exe
    2015-02-16 17:03 - 2014-04-30 04:23 - 00353280 _____ (Microsoft Corporation) C:\windows\system32\dhcpcore.dll
    2015-02-16 17:03 - 2014-04-30 03:42 - 00403968 _____ (Microsoft Corporation) C:\windows\system32\vpnike.dll
    2015-02-16 17:03 - 2014-04-28 22:40 - 00721408 _____ (Microsoft Corporation) C:\windows\system32\fveapi.dll
    2015-02-16 17:03 - 2014-04-14 09:37 - 02125344 _____ (Microsoft Corporation) C:\windows\system32\d3d9.dll
    2015-02-16 17:03 - 2014-04-14 08:08 - 01797896 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d9.dll
    2015-02-16 17:02 - 2014-05-13 07:01 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\BulkOperationHost.exe
    2015-02-16 17:02 - 2014-05-03 05:36 - 00997888 _____ (Microsoft Corporation) C:\windows\system32\reseteng.dll
    2015-02-16 17:02 - 2014-05-03 05:19 - 00071168 _____ (Microsoft Corporation) C:\windows\system32\ncobjapi.dll
    2015-02-16 17:02 - 2014-05-03 05:08 - 00301056 _____ (Microsoft Corporation) C:\windows\system32\framedynos.dll
    2015-02-16 17:02 - 2014-05-03 05:07 - 00262656 _____ (Microsoft Corporation) C:\windows\system32\framedyn.dll
    2015-02-16 17:02 - 2014-05-03 04:46 - 00052736 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncobjapi.dll
    2015-02-16 17:02 - 2014-05-03 04:37 - 00235008 _____ (Microsoft Corporation) C:\windows\SysWOW64\framedynos.dll
    2015-02-16 17:02 - 2014-05-03 04:37 - 00207360 _____ (Microsoft Corporation) C:\windows\SysWOW64\framedyn.dll
    2015-02-16 17:02 - 2014-05-02 23:26 - 00050745 _____ () C:\windows\system32\srms.dat
    2015-02-16 17:02 - 2014-04-30 06:43 - 00071680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\vwififlt.sys
    2015-02-16 17:02 - 2014-04-30 06:41 - 00402432 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
    2015-02-16 17:02 - 2014-04-30 06:41 - 00096768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\agilevpn.sys
    2015-02-16 17:02 - 2014-04-30 06:41 - 00038912 _____ (Microsoft Corporation) C:\windows\system32\Drivers\vwifimp.sys
    2015-02-16 17:02 - 2014-04-30 05:45 - 00123392 _____ (Microsoft Corporation) C:\windows\system32\Robocopy.exe
    2015-02-16 17:02 - 2014-04-30 04:48 - 00106496 _____ (Microsoft Corporation) C:\windows\SysWOW64\Robocopy.exe
    2015-02-16 17:02 - 2014-04-30 04:24 - 00065024 _____ (Microsoft Corporation) C:\windows\system32\dhcpcsvc6.dll
    2015-02-16 17:02 - 2014-04-30 04:23 - 00271872 _____ (Microsoft Corporation) C:\windows\system32\dhcpcore6.dll
    2015-02-16 17:02 - 2014-04-30 04:23 - 00087552 _____ (Microsoft Corporation) C:\windows\system32\dhcpcsvc.dll
    2015-02-16 17:02 - 2014-04-30 04:14 - 00827392 _____ (Microsoft Corporation) C:\windows\system32\BFE.DLL
    2015-02-16 17:02 - 2014-04-30 03:59 - 01063424 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL
    2015-02-16 17:02 - 2014-04-30 03:46 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dhcpcore.dll
    2015-02-16 17:02 - 2014-04-30 03:46 - 00229888 _____ (Microsoft Corporation) C:\windows\SysWOW64\dhcpcore6.dll
    2015-02-16 17:02 - 2014-04-30 03:46 - 00056320 _____ (Microsoft Corporation) C:\windows\SysWOW64\dhcpcsvc6.dll
    2015-02-16 17:02 - 2014-04-30 03:45 - 00062976 _____ (Microsoft Corporation) C:\windows\SysWOW64\dhcpcsvc.dll
    2015-02-16 17:02 - 2014-04-26 16:39 - 00339456 _____ (Microsoft Corporation) C:\windows\system32\bdesvc.dll
    2015-02-16 17:02 - 2014-04-14 05:18 - 00011776 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d8thk.dll
    2015-02-16 17:01 - 2014-08-23 07:48 - 02374784 _____ (Microsoft Corporation) C:\windows\explorer.exe
    2015-02-16 17:01 - 2014-08-23 07:13 - 02084520 _____ (Microsoft Corporation) C:\windows\SysWOW64\explorer.exe
    2015-02-16 17:01 - 2014-08-23 06:10 - 00068096 _____ (Microsoft Corporation) C:\windows\system32\UXInit.dll
    2015-02-16 17:01 - 2014-08-23 05:32 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\UXInit.dll
    2015-02-16 17:01 - 2014-08-23 04:33 - 00796672 _____ (Microsoft Corporation) C:\windows\system32\uDWM.dll
    2015-02-16 17:00 - 2015-01-12 03:09 - 25056256 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
    2015-02-16 17:00 - 2015-01-12 02:48 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
    2015-02-16 17:00 - 2015-01-12 02:48 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
    2015-02-16 17:00 - 2015-01-12 02:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
    2015-02-16 17:00 - 2015-01-12 02:34 - 00816128 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
    2015-02-16 17:00 - 2015-01-12 02:25 - 19740160 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
    2015-02-16 17:00 - 2015-01-12 02:21 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
    2015-02-16 17:00 - 2015-01-12 02:08 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
    2015-02-16 17:00 - 2015-01-12 02:07 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
    2015-02-16 17:00 - 2015-01-12 02:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
    2015-02-16 17:00 - 2015-01-12 02:02 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
    2015-02-16 17:00 - 2015-01-12 01:58 - 01032704 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
    2015-02-16 17:00 - 2015-01-12 01:55 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
    2015-02-16 17:00 - 2015-01-12 01:51 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
    2015-02-16 17:00 - 2015-01-12 01:48 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
    2015-02-16 17:00 - 2015-01-12 01:48 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
    2015-02-16 17:00 - 2015-01-12 01:48 - 00374272 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
    2015-02-16 17:00 - 2015-01-12 01:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
    2015-02-16 17:00 - 2015-01-12 01:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
    2015-02-16 17:00 - 2015-01-12 01:43 - 14401024 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
    2015-02-16 17:00 - 2015-01-12 01:34 - 00128000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
    2015-02-16 17:00 - 2015-01-12 01:30 - 00880128 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
    2015-02-16 17:00 - 2015-01-12 01:27 - 02865152 _____ (Microsoft Corporation) C:\windows\system32\actxprxy.dll
    2015-02-16 17:00 - 2015-01-12 01:27 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
    2015-02-16 17:00 - 2015-01-12 01:25 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
    2015-02-16 17:00 - 2015-01-12 01:23 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
    2015-02-16 17:00 - 2015-01-12 01:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
    2015-02-16 17:00 - 2015-01-12 01:23 - 00327168 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
    2015-02-16 17:00 - 2015-01-12 01:14 - 12829184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
    2015-02-16 17:00 - 2015-01-12 01:14 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
    2015-02-16 17:00 - 2015-01-12 01:02 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
    2015-02-16 17:00 - 2015-01-12 01:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
    2015-02-16 17:00 - 2015-01-12 00:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
    2015-02-16 17:00 - 2015-01-12 00:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
    2015-02-16 17:00 - 2015-01-10 07:00 - 00430080 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
    2015-02-16 17:00 - 2015-01-10 06:38 - 00359424 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
    2015-02-16 17:00 - 2014-11-22 02:49 - 00417280 _____ (Microsoft Corporation) C:\windows\system32\html.iec
    2015-02-16 17:00 - 2014-11-22 02:06 - 00340992 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
    2015-02-16 17:00 - 2014-11-22 02:06 - 00145408 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
    2015-02-16 17:00 - 2014-11-22 02:05 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
    2015-02-16 17:00 - 2014-11-22 01:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
    2015-02-16 17:00 - 2014-11-22 01:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
    2015-02-16 17:00 - 2014-10-31 05:12 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe
    2015-02-16 17:00 - 2014-10-31 05:12 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe
    2015-02-16 17:00 - 2014-10-31 05:10 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe
    2015-02-16 17:00 - 2014-10-31 05:09 - 00064512 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll
    2015-02-16 17:00 - 2014-10-31 05:08 - 00012800 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe
    2015-02-16 17:00 - 2014-10-31 05:06 - 00237568 _____ (Microsoft Corporation) C:\windows\system32\url.dll
    2015-02-16 17:00 - 2014-10-31 05:06 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
    2015-02-16 17:00 - 2014-10-31 05:06 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
    2015-02-16 17:00 - 2014-10-31 04:57 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
    2015-02-16 17:00 - 2014-10-31 04:56 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
    2015-02-16 17:00 - 2014-10-31 04:54 - 00132096 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll
    2015-02-16 17:00 - 2014-10-31 04:53 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
    2015-02-16 17:00 - 2014-10-31 04:52 - 00108544 _____ (Microsoft Corporation) C:\windows\system32\hlink.dll
    2015-02-16 17:00 - 2014-10-31 04:51 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
    2015-02-16 17:00 - 2014-10-31 04:51 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
    2015-02-16 17:00 - 2014-10-31 04:50 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
    2015-02-16 17:00 - 2014-10-31 04:40 - 00033280 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll
    2015-02-16 17:00 - 2014-10-31 04:30 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
    2015-02-16 17:00 - 2014-10-31 04:29 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
    2015-02-16 17:00 - 2014-10-31 04:29 - 00087552 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx
    2015-02-16 17:00 - 2014-10-31 04:28 - 00107520 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
    2015-02-16 17:00 - 2014-10-31 04:25 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
    2015-02-16 17:00 - 2014-10-31 04:24 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll
    2015-02-16 17:00 - 2014-10-31 04:19 - 00152064 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
    2015-02-16 17:00 - 2014-10-31 03:42 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll
    2015-02-16 17:00 - 2014-10-31 03:28 - 00137728 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe
    2015-02-16 17:00 - 2014-10-31 03:28 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe
    2015-02-16 17:00 - 2014-10-31 03:27 - 00152064 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe
    2015-02-16 17:00 - 2014-10-31 03:26 - 00057344 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll
    2015-02-16 17:00 - 2014-10-31 03:25 - 00011264 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe
    2015-02-16 17:00 - 2014-10-31 03:24 - 00235520 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
    2015-02-16 17:00 - 2014-10-31 03:24 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
    2015-02-16 17:00 - 2014-10-31 03:23 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
    2015-02-16 17:00 - 2014-10-31 03:16 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
    2015-02-16 17:00 - 2014-10-31 03:15 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
    2015-02-16 17:00 - 2014-10-31 03:14 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll
    2015-02-16 17:00 - 2014-10-31 03:13 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
    2015-02-16 17:00 - 2014-10-31 03:13 - 00099328 _____ (Microsoft Corporation) C:\windows\SysWOW64\hlink.dll
    2015-02-16 17:00 - 2014-10-31 03:12 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
    2015-02-16 17:00 - 2014-10-31 03:11 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
    2015-02-16 17:00 - 2014-10-31 03:03 - 00027136 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll
    2015-02-16 17:00 - 2014-10-31 02:57 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
    2015-02-16 17:00 - 2014-10-31 02:56 - 00091136 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
    2015-02-16 17:00 - 2014-10-31 02:56 - 00090624 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
    2015-02-16 17:00 - 2014-10-31 02:56 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx
    2015-02-16 17:00 - 2014-10-31 02:53 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
    2015-02-16 17:00 - 2014-10-31 02:53 - 00052736 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll
    2015-02-16 17:00 - 2014-10-31 02:48 - 00130048 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
    2015-02-16 17:00 - 2014-10-31 02:26 - 01042944 _____ (Microsoft Corporation) C:\windows\SysWOW64\actxprxy.dll
    2015-02-16 17:00 - 2014-10-31 02:24 - 00040448 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll
    2015-02-16 17:00 - 2014-02-06 11:30 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
    2015-02-16 16:59 - 2015-01-10 09:10 - 07472960 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
    2015-02-16 16:59 - 2015-01-10 09:10 - 01733440 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
    2015-02-16 16:59 - 2015-01-10 08:28 - 01498360 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
    2015-02-16 16:59 - 2014-10-29 02:02 - 00285184 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
    2015-02-16 16:58 - 2015-01-19 18:42 - 01487976 _____ (Microsoft Corporation) C:\windows\system32\sppobjs.dll
    2015-02-16 16:58 - 2014-12-19 06:26 - 00140800 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
    2015-02-16 16:58 - 2014-12-12 02:04 - 00087040 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
    2015-02-16 16:58 - 2014-12-12 00:51 - 00075776 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ahcache.sys
    2015-02-16 16:58 - 2014-10-29 02:02 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
    2015-02-16 16:58 - 2014-10-29 01:57 - 00016896 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
    2015-02-16 16:58 - 2014-10-29 01:15 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
    2015-02-16 16:58 - 2014-10-29 01:15 - 00005632 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
    2015-02-16 16:58 - 2014-10-29 01:14 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
    2015-02-16 16:58 - 2014-10-29 01:13 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
    2015-02-16 16:58 - 2014-10-29 01:13 - 00008704 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
    2015-02-16 16:58 - 2014-10-23 05:48 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\packager.dll
    2015-02-16 16:58 - 2014-10-23 05:05 - 00072192 _____ (Microsoft Corporation) C:\windows\SysWOW64\packager.dll
    2015-02-16 16:58 - 2014-10-13 02:43 - 00238912 ____C (Microsoft Corporation) C:\windows\system32\Drivers\sdbus.sys
    2015-02-16 16:58 - 2014-10-13 02:43 - 00153920 ____C (Microsoft Corporation) C:\windows\system32\Drivers\dumpsd.sys
    2015-02-16 16:58 - 2014-10-13 02:43 - 00086336 _____ (Microsoft Corporation) C:\windows\system32\Drivers\pdc.sys
    2015-02-16 16:58 - 2014-10-13 02:43 - 00039744 ____C (Microsoft Corporation) C:\windows\system32\Drivers\intelpep.sys
    2015-02-16 16:58 - 2014-09-04 00:12 - 00590336 _____ (Microsoft Corporation) C:\windows\system32\rastls.dll
    2015-02-16 16:58 - 2014-09-04 00:01 - 00514048 _____ (Microsoft Corporation) C:\windows\SysWOW64\rastls.dll
    2015-02-16 16:58 - 2014-08-16 04:08 - 01507648 _____ (Microsoft Corporation) C:\windows\system32\propsys.dll
    2015-02-16 16:58 - 2014-08-16 03:58 - 01112512 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
    2015-02-16 16:58 - 2014-08-16 03:16 - 01205976 _____ (Microsoft Corporation)
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...